Package com.tonic.analysis.cpg.taint

Class TaintSink

java.lang.Object

com.tonic.analysis.cpg.taint.TaintSink

public class TaintSink
extends Object

A regex-matched method call site where tainted data causes a vulnerability, carrying the argument index that must stay untainted.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	TaintSink.Builder	Mutable accumulator for the fields of a TaintSink.

Method Summary

Modifier and Type	Method	Description
static TaintSink.Builder	builder()
static TaintSink	commandInjection()
static TaintSink	custom(String name, String owner, String method, VulnerabilityType vulnType, Severity severity)	Builds a sink from caller-supplied patterns, fixing the sensitive argument at index 0.
static TaintSink	deserializationSink()
String	getDescriptorPattern()
String	getMethodPattern()
String	getName()
String	getOwnerPattern()
int	getSensitiveArgumentIndex()
Severity	getSeverity()
VulnerabilityType	getVulnerabilityType()
static TaintSink	ldapInjection()
static TaintSink	logInjection()
boolean	matches(String owner, String method, String descriptor)	Tests a full call target against all three patterns.
boolean	matchesDescriptor(String descriptor)	Tests a descriptor against the descriptor pattern, compiling and caching it on first use.
boolean	matchesMethod(String method)	Tests a method name against the method pattern, compiling and caching it on first use.
boolean	matchesOwner(String owner)	Tests an owner against the owner pattern, compiling and caching it on first use.
static TaintSink	pathTraversal()
static TaintSink	reflectionSink()
static TaintSink	sqlInjection()
static TaintSink	ssrf()
String	toString()
static TaintSink	xpathInjection()
static TaintSink	xss()

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Detail

getName

public String getName()

Returns:

the name

getOwnerPattern

public String getOwnerPattern()

Returns:

the owner pattern

getMethodPattern

public String getMethodPattern()

Returns:

the method pattern

getDescriptorPattern

public String getDescriptorPattern()

Returns:

the descriptor pattern

getSensitiveArgumentIndex

public int getSensitiveArgumentIndex()

Returns:

the sensitive argument index

getVulnerabilityType

public VulnerabilityType getVulnerabilityType()

Returns:

the vulnerability type

getSeverity

public Severity getSeverity()

Returns:

the severity

matchesOwner

public boolean matchesOwner(String owner)

Tests an owner against the owner pattern, compiling and caching it on first use.

Parameters:

owner - internal class name to test

Returns:

true if the pattern is absent or matches in full

matchesMethod

public boolean matchesMethod(String method)

Tests a method name against the method pattern, compiling and caching it on first use.

Parameters:

method - method name to test

Returns:

true if the pattern is absent or matches in full

matchesDescriptor

public boolean matchesDescriptor(String descriptor)

Tests a descriptor against the descriptor pattern, compiling and caching it on first use.

Parameters:

descriptor - method descriptor to test

Returns:

true if the pattern is absent or matches in full

matches

public boolean matches(String owner,
                       String method,
                       String descriptor)

Tests a full call target against all three patterns.

Parameters:

owner - internal class name to test

method - method name to test

descriptor - method descriptor to test

Returns:

true if every present pattern matches

sqlInjection

public static TaintSink sqlInjection()

Returns:

a CRITICAL sink for the JDBC statement execution family, argument 0 sensitive

commandInjection

public static TaintSink commandInjection()

Returns:

a CRITICAL sink for Runtime and ProcessBuilder process launches, argument 0 sensitive

pathTraversal

public static TaintSink pathTraversal()

Returns:

a HIGH sink for java.io file constructors, argument 0 sensitive

xss

public static TaintSink xss()

Returns:

a HIGH sink for servlet response and PrintWriter output, argument 0 sensitive

ldapInjection

public static TaintSink ldapInjection()

Returns:

a HIGH sink for DirContext searches, argument 0 sensitive

xpathInjection

public static TaintSink xpathInjection()

Returns:

a HIGH sink for XPath evaluation and compilation, argument 0 sensitive

logInjection

public static TaintSink logInjection()

Returns:

a MEDIUM sink for JUL, slf4j and log4j logging calls, argument 0 sensitive

ssrf

public static TaintSink ssrf()

Returns:

a HIGH sink for URL construction and connection opening, argument 0 sensitive

deserializationSink

public static TaintSink deserializationSink()

Returns:

a CRITICAL sink for ObjectInputStream reads, with no sensitive argument (index -1)

reflectionSink

public static TaintSink reflectionSink()

Returns:

a HIGH sink for reflective class lookup and invocation, argument 0 sensitive

custom

public static TaintSink custom(String name,
                               String owner,
                               String method,
                               VulnerabilityType vulnType,
                               Severity severity)

Builds a sink from caller-supplied patterns, fixing the sensitive argument at index 0.

Parameters:

name - display name

owner - owner regex

method - method name regex

vulnType - vulnerability the sink reports

severity - severity the sink reports

Returns:

the configured sink

builder

public static TaintSink.Builder builder()

Returns:

a new empty builder

toString

public String toString()

Overrides:

toString in class Object