Skip to content

Commit 330dc1f

Browse files
ESS-ENNESS-ENN
authored
Two Java rules (#14)
* missing-secure-java * missing-httponly-java
1 parent cb2b69f commit 330dc1f

File tree

6 files changed

+251
-0
lines changed

6 files changed

+251
-0
lines changed

‎rules/java/security/missing-httponly-java.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
id: missing-httponly-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
Detected a cookie where the `HttpOnly` flag is either missing or
6+
disabled. The `HttpOnly` cookie flag instructs the browser to forbid
7+
client-side JavaScript to read the cookie. If JavaScript interaction is
8+
required, you can ignore this finding. However, set the `HttpOnly` flag to
9+
true` in all other cases.
10+
note: >-
11+
[CWE-1004]: Sensitive Cookie Without 'HttpOnly' Flag
12+
[OWASP A05:2021]: Security Misconfiguration
13+
[REFERENCES]
14+
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
15+
utils:
16+
match_without_httponly:
17+
kind: argument_list
18+
has:
19+
kind: object_creation_expression
20+
inside:
21+
stopBy: end
22+
kind: method_invocation
23+
24+
match_cc2_cookie:
25+
kind: local_variable_declaration
26+
precedes:
27+
kind: expression_statement
28+
has:
29+
kind: method_invocation
30+
has:
31+
kind: method_invocation
32+
has:
33+
kind: argument_list
34+
has:
35+
kind: string_literal
36+
match_nettycookie:
37+
kind: local_variable_declaration
38+
all:
39+
- has:
40+
stopBy: end
41+
kind: variable_declarator
42+
has:
43+
kind: object_creation_expression
44+
all:
45+
- has:
46+
stopBy: end
47+
kind: argument_list
48+
has:
49+
stopBy: end
50+
kind: string_literal
51+
precedes:
52+
stopBy: end
53+
kind: string_literal
54+
- not:
55+
precedes:
56+
stopBy: end
57+
kind: identifier
58+
regex: "http"
59+
- not:
60+
precedes:
61+
stopBy: neighbor
62+
kind: expression_statement
63+
has:
64+
stopBy: end
65+
kind: method_invocation
66+
has:
67+
stopBy: end
68+
kind: argument_list
69+
match_cookie_last:
70+
kind: argument_list
71+
has:
72+
kind: method_invocation
73+
has:
74+
kind: argument_list
75+
has:
76+
kind: string_literal
77+
78+
rule:
79+
any:
80+
- matches: match_cc2_cookie
81+
- matches: match_without_httponly
82+
- matches: match_nettycookie
83+
- matches: match_cookie_last

‎rules/java/security/missing-secure-java.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
id: missing-secure-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
Detected a cookie where the `Secure` flag is either missing or
6+
disabled. The `Secure` cookie flag instructs the browser to forbid sending
7+
the cookie over an insecure HTTP request. Set the `Secure` flag to `true`
8+
so the cookie will only be sent over HTTPS.
9+
note: >-
10+
[CWE-614]: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
11+
[OWASP A05:2021]: Security Misconfiguration
12+
[REFERENCES]
13+
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
14+
utils:
15+
match_without_httponly:
16+
kind: argument_list
17+
has:
18+
kind: object_creation_expression
19+
inside:
20+
stopBy: end
21+
kind: method_invocation
22+
23+
match_cookie_last:
24+
kind: argument_list
25+
has:
26+
kind: method_invocation
27+
has:
28+
kind: argument_list
29+
has:
30+
kind: string_literal
31+
32+
match_instance:
33+
kind: local_variable_declaration
34+
has:
35+
stopBy: end
36+
kind: identifier
37+
follows:
38+
stopBy: end
39+
kind: variable_declarator
40+
41+
match_identifier_with_simplecookie:
42+
kind: identifier
43+
inside:
44+
stopBy: end
45+
kind: local_variable_declaration
46+
all:
47+
- has:
48+
stopBy: end
49+
kind: type_identifier
50+
regex: "^SimpleCookie$|^Cookie$"
51+
- has:
52+
stopBy: neighbor
53+
kind: variable_declarator
54+
all:
55+
- has:
56+
stopBy: neighbor
57+
kind: identifier
58+
- has:
59+
stopBy: neighbor
60+
kind: object_creation_expression
61+
- not:
62+
precedes:
63+
stopBy: neighbor
64+
kind: expression_statement
65+
rule:
66+
any:
67+
- matches: match_instance
68+
- matches: match_without_httponly
69+
- matches: match_cookie_last
70+
- matches: match_identifier_with_simplecookie

‎tests/__snapshots__/missing-httponly-java-snapshot.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: missing-httponly-java
2+
snapshots:
3+
? |
4+
SimpleCookie s = new SimpleCookie("foo", "bar");
5+
( new NettyCookie( "foo", "bar" ) )
6+
Cookie cc2 = Cookie.of("zzz", "ddd");
7+
Cookie z = new NettyCookie("foo", "bar");
8+
(Cookie.of("zzz", "ddd"))
9+
: labels:
10+
- source: SimpleCookie s = new SimpleCookie("foo", "bar");
11+
style: primary
12+
start: 0
13+
end: 48
14+
- source: '"foo"'
15+
style: secondary
16+
start: 34
17+
end: 39
18+
- source: '"foo"'
19+
style: secondary
20+
start: 34
21+
end: 39
22+
- source: ("foo", "bar")
23+
style: secondary
24+
start: 33
25+
end: 47
26+
- source: new SimpleCookie("foo", "bar")
27+
style: secondary
28+
start: 17
29+
end: 47
30+
- source: s = new SimpleCookie("foo", "bar")
31+
style: secondary
32+
start: 13
33+
end: 47

‎tests/__snapshots__/missing-secure-java-snapshot.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: missing-secure-java
2+
snapshots:
3+
? |
4+
SimpleCookie s = new SimpleCookie("foo", "bar");
5+
.orElse( new NettyCookie( "foo", "bar" ) );
6+
Cookie z = new NettyCookie("foo", "bar");
7+
return HttpResponse.ok().cookie(Cookie.of("zzz", "ddd"));
8+
: labels:
9+
- source: s
10+
style: primary
11+
start: 13
12+
end: 14
13+
- source: SimpleCookie
14+
style: secondary
15+
start: 0
16+
end: 12
17+
- source: s
18+
style: secondary
19+
start: 13
20+
end: 14
21+
- source: new SimpleCookie("foo", "bar")
22+
style: secondary
23+
start: 17
24+
end: 47
25+
- source: s = new SimpleCookie("foo", "bar")
26+
style: secondary
27+
start: 13
28+
end: 47
29+
- source: SimpleCookie s = new SimpleCookie("foo", "bar");
30+
style: secondary
31+
start: 0
32+
end: 48

‎tests/java/missing-httponly-java-test.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: missing-httponly-java
2+
valid:
3+
- |
4+
Cookie c1 = getCookieSomewhere();
5+
return HttpResponse.ok().cookie(Cookie.of("foo", "bar").httpOnly(true));
6+
Cookie cookie = request.getCookies().findCookie( "foobar" )
7+
Cookie ccc = Cookie.of("zzz", "ddd");
8+
ccc.httpOnly(true).secure(true);
9+
Cookie c = new NettyCookie("foo", "bar");
10+
c.httpOnly(true);
11+
NettyCookie r = new NettyCookie("foo", "bar").httpOnly(true);
12+
invalid:
13+
- |
14+
SimpleCookie s = new SimpleCookie("foo", "bar");
15+
( new NettyCookie( "foo", "bar" ) )
16+
Cookie cc2 = Cookie.of("zzz", "ddd");
17+
Cookie z = new NettyCookie("foo", "bar");
18+
(Cookie.of("zzz", "ddd"))

‎tests/java/missing-secure-java-test.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: missing-secure-java
2+
valid:
3+
- |
4+
Cookie c1 = getCookieSomewhere();
5+
return HttpResponse.ok().cookie(Cookie.of("foo", "bar").secure(true));
6+
Cookie cookie = request.getCookies().findCookie( "foobar" )
7+
Cookie c = new NettyCookie("foo", "bar");
8+
c.secure(true);
9+
NettyCookie r = new NettyCookie("foo", "bar").secure(true);
10+
invalid:
11+
- |
12+
SimpleCookie s = new SimpleCookie("foo", "bar");
13+
.orElse( new NettyCookie( "foo", "bar" ) );
14+
Cookie z = new NettyCookie("foo", "bar");
15+
return HttpResponse.ok().cookie(Cookie.of("zzz", "ddd"));

0 commit comments

Comments
 (0)