| 1 |
/** |
| 2 |
* @name LDAP query built from user-controlled sources |
| 3 |
* @description Building an LDAP query from user-controlled sources is vulnerable to insertion of |
| 4 |
* malicious LDAP code by the user. |
| 5 |
* @kind path-problem |
| 6 |
* @problem.severity error |
| 7 |
* @id py/ldap-injection |
| 8 |
* @tags experimental |
| 9 |
* security |
| 10 |
* external/cwe/cwe-090 |
| 11 |
*/ |
| 12 |
|
| 13 |
import python |
| 14 |
import experimental.semmle.python.security.injection.LDAP |
| 15 |
import DataFlow::PathGraph |
| 16 |
|
| 17 |
from LDAPInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink |
| 18 |
where config.hasFlowPath(source, sink) |
| 19 |
select sink.getNode(), source, sink, "$@ LDAP query parameter comes from $@.", sink.getNode(), |
| 20 |
"This", source.getNode(), "a user-provided value" |
| 21 |
|
| 22 |
// a concept |
| 23 |
|
| 24 |
module LDAPEscape { |
| 25 |
abstract class Range extends DataFlow::Node { |
| 26 |
abstract DataFlow::Node getAnInput(); |
| 27 |
} |
| 28 |
} |
| 29 |
|
| 30 |
class LDAPEscape extends DataFlow::Node { |
| 31 |
LDAPEscape::Range range; |
| 32 |
|
| 33 |
LDAPEscape() { this = range } |
| 34 |
|
| 35 |
DataFlow::Node getAnInput() { result = range.getAnInput() } |
| 36 |
} |
| 37 |
|
| 38 |
// a library modeling |
| 39 |
|
| 40 |
private module LDAP2 { |
| 41 |
private class LDAP2QueryMethods extends string { |
| 42 |
LDAP2QueryMethods() { |
| 43 |
this in ["search", "search_s", "search_st", "search_ext", "search_ext_s"] |
| 44 |
} |
| 45 |
} |
| 46 |
|
| 47 |
private class LDAP2Query extends DataFlow::CallCfgNode, LDAPQuery::Range { |
| 48 |
DataFlow::Node ldapQuery; |
| 49 |
|
| 50 |
LDAP2Query() { |
| 51 |
exists(DataFlow::AttrRead searchMethod | |
| 52 |
this.getFunction() = searchMethod and |
| 53 |
API::moduleImport("ldap").getMember("initialize").getACall() = |
| 54 |
searchMethod.getObject().getALocalSource() and |
| 55 |
searchMethod.getAttributeName() instanceof LDAP2QueryMethods and |
| 56 |
( |
| 57 |
ldapQuery = this.getArg(0) |
| 58 |
or |
| 59 |
( |
| 60 |
ldapQuery = this.getArg(2) or |
| 61 |
ldapQuery = this.getArgByName("filterstr") |
| 62 |
) |
| 63 |
) |
| 64 |
) |
| 65 |
} |
| 66 |
|
| 67 |
override DataFlow::Node getQuery() { result = ldapQuery } |
| 68 |
} |
| 69 |
|
| 70 |
private class LDAP2EscapeDNCall extends DataFlow::CallCfgNode, LDAPEscape::Range { |
| 71 |
LDAP2EscapeDNCall() { |
| 72 |
this = API::moduleImport("ldap").getMember("dn").getMember("escape_dn_chars").getACall() |
| 73 |
} |
| 74 |
|
| 75 |
override DataFlow::Node getAnInput() { result = this.getArg(0) } |
| 76 |
} |
| 77 |
|
| 78 |
private class LDAP2EscapeFilterCall extends DataFlow::CallCfgNode, LDAPEscape::Range { |
| 79 |
LDAP2EscapeFilterCall() { |
| 80 |
this = |
| 81 |
API::moduleImport("ldap").getMember("filter").getMember("escape_filter_chars").getACall() |
| 82 |
} |
| 83 |
|
| 84 |
override DataFlow::Node getAnInput() { result = this.getArg(0) } |
| 85 |
} |
| 86 |
} |
| 87 |
|
| 88 |
// a taint flow config |
| 89 |
|
| 90 |
class LDAPInjectionFlowConfig extends TaintTracking::Configuration { |
| 91 |
LDAPInjectionFlowConfig() { this = "LDAPInjectionFlowConfig" } |
| 92 |
|
| 93 |
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } |
| 94 |
|
| 95 |
override predicate isSink(DataFlow::Node sink) { sink = any(LDAPQuery ldapQuery).getQuery() } |
| 96 |
|
| 97 |
override predicate isSanitizer(DataFlow::Node sanitizer) { |
| 98 |
sanitizer = any(LDAPEscape ldapEsc).getAnInput() |
| 99 |
} |
| 100 |
} |
| 101 |
|
| 102 |
// From https://github.com/github/codeql/pull/5443/files |
| 103 |
|
