Add YAML security rules for DocumentBuilderFactory external entities #163
Conversation
|
Sakshis seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
WalkthroughThis pull request introduces two new YAML configuration files that define security rules for Java applications using the Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer Code
participant Analyzer as Static Analysis Engine
participant Rule as YAML Security Rule
participant Test as Snapshot/Test Validator
Dev->>Analyzer: Write code using DocumentBuilderFactory
Analyzer->>Rule: Load external entities security rules
Rule-->>Analyzer: Provide matching patterns for setFeature invocations
Analyzer->>Analyzer: Evaluate method calls for vulnerable configurations
alt Vulnerability Detected
Analyzer-->>Dev: Emit warning for enabled external entities
else No Issue
Analyzer-->>Dev: No warning issued
end
Analyzer->>Test: Run snapshot and test validations for both scenarios
Possibly related PRs
Suggested reviewers
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
rules/java/security/documentbuilderfactory-external-general-entities-true-java.yml (2)
1-14: Metadata and Basic Configuration Check
The rule metadata is well defined with a clearid,language,severity, and an explanatorymessage. However, note that the displayed vulnerability note references “[CWE-798]: Use of Hard-coded Credentials”, which may not accurately describe an XXE issue. Consider verifying whether a CWE like CWE-611 (or another more appropriate identifier for XML external entity vulnerabilities) should be referenced instead.
180-274: Combined Matching Expression for Mixed Instances
This complex matching expression combines checks for both URL and Boolean representations in the argument list. While it is comprehensive, the nested conditions are intricate. Consider adding inline documentation or simplifying the structure where possible for improved maintainability.rules/java/security/documentbuilderfactory-external-parameter-entities-true-java.yml (1)
179-273: Combined Matching Expression for Mixed Instances
The combined block adeptly handles cases with mixed representations of arguments. Despite its complexity, it ensures a wide coverage of potential invocations. Adding a brief comment to explain the rationale behind the nested conditions might help future maintainers.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
rules/java/security/documentbuilderfactory-external-general-entities-true-java.yml(1 hunks)rules/java/security/documentbuilderfactory-external-parameter-entities-true-java.yml(1 hunks)tests/__snapshots__/documentbuilderfactory-external-general-entities-true-java-snapshot.yml(1 hunks)tests/__snapshots__/documentbuilderfactory-external-parameter-entities-true-java-snapshot.yml(1 hunks)tests/java/documentbuilderfactory-external-general-entities-true-java-test.yml(1 hunks)tests/java/documentbuilderfactory-external-parameter-entities-true-java-test.yml(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- tests/snapshots/documentbuilderfactory-external-general-entities-true-java-snapshot.yml
- tests/snapshots/documentbuilderfactory-external-parameter-entities-true-java-snapshot.yml
🔇 Additional comments (13)
tests/java/documentbuilderfactory-external-general-entities-true-java-test.yml (2)
1-5: Approved: Secure Configuration for External General Entities (Valid Cases)
The test configuration correctly defines the secure scenario by setting the feature to false for bothdbfandspf. The indentation and block literal style make it very clear.
6-9: Approved: Insecure Configuration for External General Entities (Invalid Cases)
The invalid block properly sets the feature to true, thereby simulating the vulnerable scenario for detection. Ensure your test runner interprets the multiline literal correctly.tests/java/documentbuilderfactory-external-parameter-entities-true-java-test.yml (2)
1-4: Approved: Secure Configuration for External Parameter Entities (Valid Case)
The test case correctly disables external parameter entities by setting the feature to false. The identifier and formatting are clear and concise.
5-8: Approved: Insecure Configuration for External Parameter Entities (Invalid Cases)
The invalid block appropriately triggers the detection by enabling the feature for bothdbfandspf. The setup is consistent with the intended negative test scenarios.rules/java/security/documentbuilderfactory-external-general-entities-true-java.yml (4)
16-49: Matching Expression for External General Entities (Literal Argument)
This matching expression correctly captures calls tosetFeaturethat pass the specific URL as a string literal and a"true"value as the second argument. The utilization ofregexandnthChildis appropriate and clear.
50-113: Matching Expression for Boolean Instance
This block handles cases where the booleantrueis provided as a Boolean instance. The check incorporating the exclusion of line comments is thorough. You might want to verify that all relevant representations of a true value in your codebase are being captured.
114-150: Matching Expression for Link Instance
The expression targeting cases where the first argument is treated as a URL (using$URL) and the second argument matches"^true$"is well constructed and consistent with the intended detection logic.
275-289: Overall Rule Assembly
The final rule section effectively aggregates all the individual matching expressions and uses exclusion rules to prevent false positives. The logical structure is consistent with the intended security detection.rules/java/security/documentbuilderfactory-external-parameter-entities-true-java.yml (5)
1-12: Metadata and Basic Configuration for External Parameter Entities
The rule’s metadata—comprisingid,severity,language, andmessage—is clearly specified. The note referencing “[CWE-611] Improper Restriction of XML External Entity Reference” is appropriate for external parameter entities.
15-48: Matching Expression for External Parameter Entities (Literal Argument)
This matching expression correctly identifies invocations ofsetFeaturethat are meant to set the external parameter entities by checking for the specific URL literal and a"true"value. The structure mirrors the secure pattern and is well defined.
49-112: Matching Expression for Boolean Instance
The Boolean instance matching block accurately captures boolean values provided as an instance rather than as a literal. The detailed conditions ensure that invalid configurations are reliably detected.
113-149: Matching Expression for Link Instance
This expression correctly checks for scenarios where the first argument is interpreted with a$URLplaceholder and the second argument is"true". The configuration is consistent and clear.
275-289: Overall Rule Assembly
The rule assembly, which aggregates all match expressions and applies an exclusion for error conditions, is logically structured and clear. This final section ties together the individual components effectively.
Summary by CodeRabbit
New Features
Tests