Path Query not giving results.

[akanksha1131]

This is my query to find sources

/**
 * Enhanced query to detect sources of user-controlled input
 * @name source-detect-1
 * @kind problem
 * @problem.severity warning
 * @id java/example/source-detection
 */

 import java
 import semmle.code.java.dataflow.DataFlow
 
 // Define sources of user-controlled input, tailored to specific taint sources
 predicate isSource(DataFlow::Node src, string sourceType, string sourceName, string sourceDataType) {
   // Parameters commonly associated with CWEs
   exists(Parameter p |
     p.getName() in [
       "username", "password", "remember", "target", "realName",
       "blabName", "blabberUsername", "command", "cpassword",
       "host", "fortuneFile", "count", "length", "imageName"
     ] and
     src.asParameter() = p and
     sourceType = "Parameter" and
     sourceName = p.getName() and
     sourceDataType = p.getType().toString()
   ) or
   // Method calls for cookies and session IDs
   exists(MethodAccess access |
     access.getMethod().getDeclaringType().getName() = "javax.servlet.http.HttpServletRequest" and
     (
       access.getMethod().hasName(["getCookies", "getSession", "getId"]) or
       access.getMethod().hasName("getCookieFromRequestByName")
     ) and
     src.asExpr() = access and
     sourceType = "MethodAccess" and
     sourceName = access.getMethod().getName() and
     sourceDataType = access.getType().toString()
   )
 }
 
 // Query to output each detected source with detailed information
 from DataFlow::Node source, string sourceType, string sourceName, string sourceDataType
 where isSource(source, sourceType, sourceName, sourceDataType)
 select 
   source, 
   "Source element detected in package: " + 
   source.getEnclosingCallable().getDeclaringType().getPackage().getName() + 
   ", class: " + source.getEnclosingCallable().getDeclaringType().getName() +
   ", function: " + source.getEnclosingCallable().getName() +
   ", signature: " + source.getEnclosingCallable().getQualifiedName() + 
   "(" + source.getEnclosingCallable().getSignature() + ")" +
   ". Source type: " + sourceType +
   ", Source name: " + sourceName +
   ", Source data type: " + sourceDataType
 

This is my query to find sinks

/**
 * Enhanced query to detect sinks where unvalidated data could lead to vulnerabilities
 * @name sink-detect-3
 * @kind problem
 * @problem.severity warning
 * @id java/example/sink-detection
 */

 import java
 import semmle.code.java.dataflow.DataFlow
 
 // Define sinks where unvalidated data could lead to vulnerabilities
 predicate isSink(DataFlow::Node snk) {
   // Detect file access sinks
   exists(MethodAccess fileAccess |
     fileAccess.getMethod().getDeclaringType().getName() = "java.io.File" and
     fileAccess.getMethod().hasName("transferTo") and
     snk.asExpr() = fileAccess
   )
   or
   // Detect SQL injection sinks
   exists(MethodAccess sqlMethod |
     sqlMethod.getMethod().getDeclaringType().getName() = "java.sql.Statement" and
     (
       sqlMethod.getMethod().hasName("executeQuery") or
       sqlMethod.getMethod().hasName("executeUpdate") or
       sqlMethod.getMethod().hasName("execute")
     ) and
     snk.asExpr() = sqlMethod
   )
   or
   // Detect command execution sinks
   exists(MethodAccess cmdExec |
     cmdExec.getMethod().getDeclaringType().getName() = "java.lang.Runtime" and
     cmdExec.getMethod().hasName("exec") or
     cmdExec.getMethod().getDeclaringType().getName() = "java.lang.ProcessBuilder" and
     cmdExec.getMethod().hasName("start") and
     snk.asExpr() = cmdExec
   )
   or
   // Detect object stream access sinks
   exists(MethodAccess objectStreamAccess |
     objectStreamAccess.getMethod().getDeclaringType().getName() = "java.io.ObjectInputStream" and
     objectStreamAccess.getMethod().hasName("readObject") and
     snk.asExpr() = objectStreamAccess
   )
   or
   // Detect string concatenation sinks
   exists(BinaryExpr concatExpr |
     (concatExpr.getLeftOperand() instanceof Literal or concatExpr.getRightOperand() instanceof Literal) and
     snk.asExpr() = concatExpr
   )
   or
   // Detect format method sinks
   exists(MethodAccess formatAccess |
     formatAccess.getMethod().hasName("format") and
     snk.asExpr() = formatAccess
   )
   or
   // Detect session management sinks
   exists(MethodAccess sessionUtils |
     sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
     (
       sessionUtils.getMethod().hasName("setSessionUserName") or
       sessionUtils.getMethod().hasName("setUsernameCookie")
     ) and
     snk.asExpr() = sessionUtils
   )
   or
   // Detect MessageDigest method sinks
   exists(MethodAccess digestMethod |
     digestMethod.getMethod().getDeclaringType().getName() = "java.security.MessageDigest" and
     digestMethod.getMethod().hasName("getInstance") and
     snk.asExpr() = digestMethod
   )
   or
   // Detect Class.forName method sinks
   exists(MethodAccess classForName |
     classForName.getMethod().getDeclaringType().getName() = "java.lang.Class" and
     classForName.getMethod().hasName("forName") and
     snk.asExpr() = classForName
   )
   or
   // Detect Logger method sinks
   exists(MethodAccess loggerMethod |
     loggerMethod.getMethod().getDeclaringType().getName().matches(".*Logger.*") and
     loggerMethod.getMethod().hasName("info") and
     snk.asExpr() = loggerMethod
   )
   or
   // Detect file input stream sinks
   exists(MethodAccess fileIO |
     fileIO.getMethod().getDeclaringType().getName() = "java.io.FileInputStream" and
     fileIO.getMethod().hasName("FileInputStream") and
     snk.asExpr() = fileIO
   )
   or
   // Detect path concatenation sinks
   exists(BinaryExpr pathConcat |
     pathConcat.getLeftOperand() instanceof Literal and
     snk.asExpr() = pathConcat
   )
 }
 
 // Query to output each detected sink with its package, class, function declaration, and signature
 from DataFlow::Node sink
 where isSink(sink)
 select 
  sink, 
  "Sink element in type: " + sink.getEnclosingCallable().getDeclaringType().getName() + 
  ", method: " + sink.getEnclosingCallable().getName() +
  ", signature: " + sink.getEnclosingCallable().getQualifiedName() + 
  "(" + sink.getEnclosingCallable().getSignature() + ")" +
  ", sink data type: " + sink.getType().getName()

This is my query to find paths from sources and sinks (I have used the same predicates that were in the source and sink detection query, in the path query )

/**
 * @kind path-problem
 * @name Path Between Sources and Sinks
 * @id java/example/path-detection
 * @description Tracks paths between sources and sinks where unvalidated data may lead to vulnerabilities.
 */

 import java
 import semmle.code.java.dataflow.DataFlow
 
 /**
  * Define sources of user-controlled input.
  */
 predicate isSource(DataFlow::Node src) {
    // Parameters commonly associated with CWEs
    exists(Parameter p |
      p.getName() in [
        "username", "password", "remember", "target", "realName",
        "blabName", "blabberUsername", "command", "cpassword",
        "host", "fortuneFile", "count", "length", "imageName"
      ] 
    ) or
    // Method calls for cookies and session IDs
    exists(MethodAccess access |
      access.getMethod().getDeclaringType().getName() = "javax.servlet.http.HttpServletRequest" and
      (
        access.getMethod().hasName(["getCookies", "getSession", "getId"]) or
        access.getMethod().hasName("getCookieFromRequestByName")
      ) and
      src.asExpr() = access 
    )
  }
 
 /**
  * Define sinks where unvalidated data could lead to vulnerabilities.
  */
 predicate isSink(DataFlow::Node snk) {
    // Detect file access sinks
    exists(MethodAccess fileAccess |
      fileAccess.getMethod().getDeclaringType().getName() = "java.io.File" and
      fileAccess.getMethod().hasName("transferTo") and
      snk.asExpr() = fileAccess
    )
    or
    // Detect SQL injection sinks
    exists(MethodAccess sqlMethod |
      sqlMethod.getMethod().getDeclaringType().getName() = "java.sql.Statement" and
      (
        sqlMethod.getMethod().hasName("executeQuery") or
        sqlMethod.getMethod().hasName("executeUpdate") or
        sqlMethod.getMethod().hasName("execute")
      ) and
      snk.asExpr() = sqlMethod
    )
    or
    // Detect command execution sinks
    exists(MethodAccess cmdExec |
      cmdExec.getMethod().getDeclaringType().getName() = "java.lang.Runtime" and
      cmdExec.getMethod().hasName("exec") or
      cmdExec.getMethod().getDeclaringType().getName() = "java.lang.ProcessBuilder" and
      cmdExec.getMethod().hasName("start") and
      snk.asExpr() = cmdExec
    )
    or
    // Detect object stream access sinks
    exists(MethodAccess objectStreamAccess |
      objectStreamAccess.getMethod().getDeclaringType().getName() = "java.io.ObjectInputStream" and
      objectStreamAccess.getMethod().hasName("readObject") and
      snk.asExpr() = objectStreamAccess
    )
    or
    // Detect string concatenation sinks
    exists(BinaryExpr concatExpr |
      (concatExpr.getLeftOperand() instanceof Literal or concatExpr.getRightOperand() instanceof Literal) and
      snk.asExpr() = concatExpr
    )
    or
    // Detect format method sinks
    exists(MethodAccess formatAccess |
      formatAccess.getMethod().hasName("format") and
      snk.asExpr() = formatAccess
    )
    or
    // Detect session management sinks
    exists(MethodAccess sessionUtils |
      sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
      (
        sessionUtils.getMethod().hasName("setSessionUserName") or
        sessionUtils.getMethod().hasName("setUsernameCookie")
      ) and
      snk.asExpr() = sessionUtils
    )
    or
    // Detect MessageDigest method sinks
    exists(MethodAccess digestMethod |
      digestMethod.getMethod().getDeclaringType().getName() = "java.security.MessageDigest" and
      digestMethod.getMethod().hasName("getInstance") and
      snk.asExpr() = digestMethod
    )
    or
    // Detect Class.forName method sinks
    exists(MethodAccess classForName |
      classForName.getMethod().getDeclaringType().getName() = "java.lang.Class" and
      classForName.getMethod().hasName("forName") and
      snk.asExpr() = classForName
    )
    or
    // Detect Logger method sinks
    exists(MethodAccess loggerMethod |
      loggerMethod.getMethod().getDeclaringType().getName().matches(".*Logger.*") and
      loggerMethod.getMethod().hasName("info") and
      snk.asExpr() = loggerMethod
    )
    or
    // Detect file input stream sinks
    exists(MethodAccess fileIO |
      fileIO.getMethod().getDeclaringType().getName() = "java.io.FileInputStream" and
      fileIO.getMethod().hasName("FileInputStream") and
      snk.asExpr() = fileIO
    )
    or
    // Detect path concatenation sinks
    exists(BinaryExpr pathConcat |
      pathConcat.getLeftOperand() instanceof Literal and
      snk.asExpr() = pathConcat
    )
  }
 
 /**
  * Main query to detect and visualize paths from sources to sinks.
  */
 from DataFlow::PathNode source, DataFlow::PathNode sink
 where isSource(source.getNode()) and isSink(sink.getNode()) and source.getNode() = sink.getNode()
 select
   sink, source, sink,
   "Data flows from source to sink:\nSource: " +
   source.getNode().getEnclosingCallable().getQualifiedName() +
   "\nSink: " + sink.getNode().getEnclosingCallable().getQualifiedName()
 

The path query doesnt give any result:

Now, the code repository that is being queried, HAS a path from source to sink. (The source sink pairs are documented here).

Now, there are functions like (for example)

public String processLogin(
            @RequestParam(value = "user", required = true) String username,
            @RequestParam(value = "password", required = true) String password,
            @RequestParam(value = "remember", required = false) String remember,
            @RequestParam(value = "target", required = false) String target,
            Model model,
            HttpServletRequest req,
            HttpServletResponse response)

Here the paramteres are the sources.
Inside this function there is

Utils.setUsernameCookie(response, result.getString("username"));

which is a sink. Here the source and sink are getting detected individually, however the path between them is not being detected. Can anyone help why?

[redsun82]

👋 @akanksha1131

What seems not working in your code is the source.getNode() = sink.getNode() bit in your final query: that will only be true for data flow paths of length 0 where the source and the sink are the very same node, which is not what you probably intended.

I'll try to provide a few pointers to move from here:

• This article contains a guide to performing global data flow in Java. It seems you are missing a dataflow configuration in which to put your isSource and isSink predicates and from which then to call the flow predicate.
• When a query does not provide the results you expect, you can try to debug it using quick evaluation in VSCode. You can quick-evaluate both a single predicate as well as a part of a predicate that you highlight in VSCode, which makes it a very potent debugging tool.

[akanksha1131]

@redsun82 Thanks a ton!!

/**
 * @kind path-problem
 * @name Path 
 * @id java/example/path-detection
 * @description Tracks paths between sources and sinks where unvalidated data may lead to vulnerabilities.
 */
import semmle.code.java.dataflow.DataFlow

module MyFlowConfiguration implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node src) {
    // Parameters commonly associated with CWEs
    exists(Parameter p |
      p.getName() in [
        "username", "password", "remember", "target", "realName",
        "blabName", "blabberUsername", "command", "cpassword",
        "host", "fortuneFile", "count", "length", "imageName"
      ] 
    ) or
    // Method calls for cookies and session IDs
    exists(MethodAccess access |
      access.getMethod().getDeclaringType().getName() = "javax.servlet.http.HttpServletRequest" and
      (
        access.getMethod().hasName(["getCookies", "getSession", "getId"]) or
        access.getMethod().hasName("getCookieFromRequestByName")
      ) and
      src.asExpr() = access 
    )
  }
 
 /**
  * Define sinks where unvalidated data could lead to vulnerabilities.
  */
 predicate isSink(DataFlow::Node snk) {
    // Detect file access sinks
    exists(MethodAccess fileAccess |
      fileAccess.getMethod().getDeclaringType().getName() = "java.io.File" and
      fileAccess.getMethod().hasName("transferTo") and
      snk.asExpr() = fileAccess
    )
    or
    // Detect SQL injection sinks
    exists(MethodAccess sqlMethod |
      sqlMethod.getMethod().getDeclaringType().getName() = "java.sql.Statement" and
      (
        sqlMethod.getMethod().hasName("executeQuery") or
        sqlMethod.getMethod().hasName("executeUpdate") or
        sqlMethod.getMethod().hasName("execute")
      ) and
      snk.asExpr() = sqlMethod
    )
    or
    // Detect command execution sinks
    exists(MethodAccess cmdExec |
      cmdExec.getMethod().getDeclaringType().getName() = "java.lang.Runtime" and
      cmdExec.getMethod().hasName("exec") or
      cmdExec.getMethod().getDeclaringType().getName() = "java.lang.ProcessBuilder" and
      cmdExec.getMethod().hasName("start") and
      snk.asExpr() = cmdExec
    )
    or
    // Detect object stream access sinks
    exists(MethodAccess objectStreamAccess |
      objectStreamAccess.getMethod().getDeclaringType().getName() = "java.io.ObjectInputStream" and
      objectStreamAccess.getMethod().hasName("readObject") and
      snk.asExpr() = objectStreamAccess
    )
    or
    // Detect string concatenation sinks
    exists(BinaryExpr concatExpr |
      (concatExpr.getLeftOperand() instanceof Literal or concatExpr.getRightOperand() instanceof Literal) and
      snk.asExpr() = concatExpr
    )
    or
    // Detect format method sinks
    exists(MethodAccess formatAccess |
      formatAccess.getMethod().hasName("format") and
      snk.asExpr() = formatAccess
    )
    or
    // Detect session management sinks
    exists(MethodAccess sessionUtils |
      sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
      (
        sessionUtils.getMethod().hasName("setSessionUserName") or
        sessionUtils.getMethod().hasName("setUsernameCookie")
      ) and
      snk.asExpr() = sessionUtils
    )
    or
    // Detect MessageDigest method sinks
    exists(MethodAccess digestMethod |
      digestMethod.getMethod().getDeclaringType().getName() = "java.security.MessageDigest" and
      digestMethod.getMethod().hasName("getInstance") and
      snk.asExpr() = digestMethod
    )
    or
    // Detect Class.forName method sinks
    exists(MethodAccess classForName |
      classForName.getMethod().getDeclaringType().getName() = "java.lang.Class" and
      classForName.getMethod().hasName("forName") and
      snk.asExpr() = classForName
    )
    or
    // Detect Logger method sinks
    exists(MethodAccess loggerMethod |
      loggerMethod.getMethod().getDeclaringType().getName().matches(".*Logger.*") and
      loggerMethod.getMethod().hasName("info") and
      snk.asExpr() = loggerMethod
    )
    or
    // Detect file input stream sinks
    exists(MethodAccess fileIO |
      fileIO.getMethod().getDeclaringType().getName() = "java.io.FileInputStream" and
      fileIO.getMethod().hasName("FileInputStream") and
      snk.asExpr() = fileIO
    )
    or
    // Detect path concatenation sinks
    exists(BinaryExpr pathConcat |
      pathConcat.getLeftOperand() instanceof Literal and
      snk.asExpr() = pathConcat
    )
  }
}

module MyFlow = DataFlow::Global<MyFlowConfiguration>;
from DataFlow::Node source, DataFlow::Node sink
where MyFlow::flow(source, sink)
select source, "Data flow to $@.", sink, sink.toString()

It is giving me the source and sinks!