Skip to content

Commit 834e8d9

Browse files
carlspringcarlspring
committed
#14 : Implement a CodeQL query that checks for invocations of Vertx.vertx()
* Implemented CodeQL query. * Implemented test case. * Added a query help file.
1 parent c198799 commit 834e8d9

File tree

8 files changed

+199
-0
lines changed

8 files changed

+199
-0
lines changed

‎src/main/java/org/carlspring/security/vertx/http/InvocationOfVertxVertx.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package org.carlspring.security.vertx.http;
2+
3+
import io.vertx.core.Vertx;
4+
5+
/**
6+
* @author carlspring
7+
*/
8+
public class InvocationOfVertxVertx
9+
{
10+
11+
public void start()
12+
{
13+
Vertx.vertx();
14+
}
15+
16+
}

‎src/main/ql/InvocationOfVertxVertx.qhelp‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
x<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>
7+
An HTTP server which does not use SSL/TLS is vulnerable to man-in-the-middle attacks.
8+
</p>
9+
<p>
10+
Please, note that it may be safe to ignore this, only if you intend your application to be placed
11+
behind a loadbalancer, which is itself securing the connections with the appropriate certificates.
12+
</p>
13+
</overview>
14+
15+
<recommendation>
16+
<p>Use SSL/TLS to encrypt the communication between the client and the server.</p>
17+
</recommendation>
18+
19+
<example>
20+
<p>Instead of setting up a plain HTTP server that doesn't use SSL, such as this one:</p>
21+
22+
<sample src="InsecureHttpServer.java" />
23+
24+
<p>
25+
when creating an HTTP server, the <code>setSsl</code> method should be called on the
26+
<code>HttpServerOptions</code>
27+
object, and the <code>setKeyStoreOptions</code> method should be called on the
28+
<code>HttpServerOptions</code>
29+
object with a <code>KeyStoreOptions</code>
30+
object as an argument.
31+
32+
For example, code such as the one illustrated below should be used to create an HTTP server and secure
33+
it with SSL:
34+
</p>
35+
36+
<sample src="SecureHttpServer.java" />
37+
</example>
38+
39+
<references>
40+
<li>
41+
<a href="https://vertx.io/docs/vertx-core/java/#_writing_http_servers_and_clients">
42+
Vert.x documentation
43+
</a>
44+
</li>
45+
</references>
46+
</qhelp>

‎src/main/ql/InvocationOfVertxVertx.ql‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* @name Invocation of VertX.vertx()
3+
* @description The VertX.vertx() method should not be invoked directly.
4+
* @kind problem
5+
* @problem.severity high
6+
* @id java/vertx/invocation-of-vertx-vertx
7+
* @tags security java/vertx
8+
*/
9+
10+
import java
11+
12+
class Vertx extends RefType {
13+
Vertx() {
14+
this.getASourceSupertype*().hasQualifiedName("io.vertx.core", "Vertx")
15+
}
16+
}
17+
18+
class VertxCreateHttpServerMethodAccess extends MethodAccess {
19+
VertxCreateHttpServerMethodAccess() {
20+
exists(Method m |
21+
this.getMethod() = m and
22+
m.getName().matches("vertx") and
23+
m.getDeclaringType() instanceof Vertx
24+
)
25+
}
26+
}
27+
28+
from VertxCreateHttpServerMethodAccess call
29+
where
30+
not call.getEnclosingCallable().getDeclaringType() instanceof Vertx and
31+
not call.getLocation().getFile().getRelativePath().matches("%src/test/%") and
32+
call.getNumArgument() = 0
33+
select
34+
call,
35+
"Invocation of VertX.vertx()"

‎src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| InvocationOfVertxVertx.java:13:9:13:21 | vertx(...) | Invocation of VertX.vertx() |

‎src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package org.carlspring.security.vertx.http;
2+
3+
import io.vertx.core.Vertx;
4+
5+
/**
6+
* @author carlspring
7+
*/
8+
public class InvocationOfVertxVertx
9+
{
10+
11+
public void start()
12+
{
13+
Vertx.vertx();
14+
}
15+
16+
}

‎src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
InvocationOfVertxVertx.ql

‎src/test/ql/test/query-tests/InvocationOfVertxVertx/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/ -source 17

‎src/test/ql/test/query-tests/InvocationOfVertxVertx/pom.xml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0">
2+
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>org.carlspring.security</groupId>
6+
<artifactId>vertx-vulns-test-invocation-of-vertx-vertx</artifactId>
7+
<version>1.0.0-SNAPSHOT</version>
8+
9+
<properties>
10+
<version.vertx>4.4.4</version.vertx>
11+
</properties>
12+
13+
<build>
14+
<plugins>
15+
<plugin>
16+
<groupId>org.apache.maven.plugins</groupId>
17+
<artifactId>maven-clean-plugin</artifactId>
18+
<version>3.3.1</version>
19+
</plugin>
20+
<plugin>
21+
<groupId>org.apache.maven.plugins</groupId>
22+
<artifactId>maven-compiler-plugin</artifactId>
23+
<version>3.11.0</version>
24+
<configuration>
25+
<source>17</source>
26+
<target>17</target>
27+
<debug>true</debug>
28+
</configuration>
29+
</plugin>
30+
<plugin>
31+
<groupId>org.apache.maven.plugins</groupId>
32+
<artifactId>maven-install-plugin</artifactId>
33+
<version>3.1.1</version>
34+
</plugin>
35+
<plugin>
36+
<groupId>org.apache.maven.plugins</groupId>
37+
<artifactId>maven-resources-plugin</artifactId>
38+
<version>3.3.1</version>
39+
<configuration>
40+
<includeEmptyDirs>true</includeEmptyDirs>
41+
</configuration>
42+
</plugin>
43+
</plugins>
44+
</build>
45+
46+
<dependencies>
47+
<dependency>
48+
<groupId>io.vertx</groupId>
49+
<artifactId>vertx-core</artifactId>
50+
<version>${version.vertx}</version>
51+
</dependency>
52+
<dependency>
53+
<groupId>io.vertx</groupId>
54+
<artifactId>vertx-web</artifactId>
55+
<version>${version.vertx}</version>
56+
</dependency>
57+
<dependency>
58+
<groupId>io.vertx</groupId>
59+
<artifactId>vertx-web-client</artifactId>
60+
<version>${version.vertx}</version>
61+
</dependency>
62+
63+
<dependency>
64+
<groupId>io.vertx</groupId>
65+
<artifactId>vertx-jdbc-client</artifactId>
66+
<version>${version.vertx}</version>
67+
</dependency>
68+
69+
<dependency>
70+
<groupId>io.vertx</groupId>
71+
<artifactId>vertx-rx-java2</artifactId>
72+
<version>${version.vertx}</version>
73+
</dependency>
74+
75+
<dependency>
76+
<groupId>io.vertx</groupId>
77+
<artifactId>vertx-sql-client</artifactId>
78+
<version>${version.vertx}</version>
79+
</dependency>
80+
81+
</dependencies>
82+
83+
</project>

0 commit comments

Comments
 (0)