codeql从入门到入土

codeql database create 数据库名 --language=cpp --source-root=源码路径 --command="编译命令"

#因为我这里没有安装gpg，所以这里直接跳过gpg签名
codeql database create DatabaseName --language=java --command="mvn clean install -Dgpg.skip=true" --source-root=D:\xxl-job --overwrite

#下载源代码
git clone https://gitee.com/xuxueli0323/xxl-job 

#创建源码数据库：
codeql database create DatabaseName --language=java --command="mvn clean install -Dgpg.skip=true" --source-root=D:\xxl-job 
codeql database create DatabaseName --language=java --command="mvn clean install -Dgpg.skip=true" --source-root=D:\text\subtitles-view-main

#创建数据库
codeql database create databaseName --source-root=D:/xxl-job --language=java

#更新数据库
codeql database upgrade databaseName

#执行扫描规则

codeql database analyze Databasepath codeql-repo/java --format=csv --output=result.csv
#eg:codeql database analyze D:\xxl-job\databaseName D:\codeql\ql\java\ql\src\Security\CWE --format=csv --output=result.csv

codeql database analyze D:\text\java-sec-code-master\mybatis_3_db D:\codeql\ql\java\ql\src\Security\CWE --format=csv --output=result.csv

from [datatype] var
where condition(var = something)
select var

getACallable() 获取所有可以调用方法(其中包括构造方法)
getAMember() 获取所有成员，其中包括调用方法，字段和内部类这些
getAField() 获取所有字段
getAMethod() 获取所有方法
getASupertype() 获取父类
getAnAncestor() 获取所有的父类相当于递归的getASupertype*()

polyCalls(Callable target) 一个Callable 是否调用了另外的Callable，这里面包含了类似虚函数的调用
hasName(name) 可以对方法名进行限制

getCallee() 返回函数声明的位置
getCaller() 返回调用这个函数的函数位置

- **source**是指漏洞污染链条的**输入点**。比如获取http请求的参数部分，就是非常明显的Source。
- **sink**是指漏洞污染链条的**执行点**，比如SQL注入漏洞，最终执行SQL语句的函数就是sink(这个函数可能叫query或者exeSql，或者其它)。
- **sanitizer**又叫**净化函数**，是指在整个的漏洞链条当中，如果存在一个方法阻断了整个传递链，那么这个方法就叫sanitizer。

predicate isSink(DataFlow::Node sink) { sinkNode(sink, "log-injection") }

predicate isSource(DataFlow::Node src) {
     src instanceof RemoteFlowSource
   }

predicate isSink(DataFlow::Node sink) {
     exists(Method method, MethodCall call |
       method.hasName("query") and
       call.getMethod() = method and
       sink.asExpr() = call.getArgument(0)
     )
   }

module MyFlow = DataFlow::Global<MyConfig>;
import MyFlow::PathGraph

from MyFlow::PathNode source, MyFlow::PathNode sink
where MyFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "Data flow found"

codeql database create DATABASE --language="java" --source-root=D:\text\micro_service_seclab-main --command="mvn clean package -Dmaven.test.skip=true"

/**
 * @id   java/examples/vuldemo
 * @name Sql-Injection
 * @description Sql-Injection
 * @kind path-problem
 * @problem.severity warning
 */

 import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.QueryInjection

 module SqlInjectionConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node src) {
     src instanceof RemoteFlowSource
   }
 
   predicate isSink(DataFlow::Node sink) {
     exists(Method method, MethodCall call |
       method.hasName("query") and
       call.getMethod() = method and
       sink.asExpr() = call.getArgument(0)
     )
   }
 }
 

 module SqlFlow = TaintTracking::Global<SqlInjectionConfig>;
 

 import SqlFlow::PathGraph

 from SqlFlow::PathNode source, SqlFlow::PathNode sink
 where SqlFlow::flowPath(source, sink)
 select sink.getNode(), source, sink,
        "Potential SQL-injection: user input flows to SQL query."

module MyFlow = TaintTracking::Global<MyConfig>;
import MyFlow::PathGraph

from MyFlow::PathNode source, MyFlow::PathNode sink
where MyFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "Data flow found"

  predicate isBarrier(DataFlow::Node sanitizer) {  // 4: 'isBarrier' replaces 'isSanitizer'
    sanitizer.asExpr() instanceof LiveLiteral or
    sanitizer.getType() instanceof PrimitiveType or
    sanitizer.getType() instanceof BoxedType or
    sanitizer.getType() instanceof NumberType or
    sanitizer.getType() instanceof TypeType
  }

 predicate isBarrier(DataFlow::Node sanitizer) {  // 4: 'isBarrier' replaces 'isSanitizer'
      sanitizer.getType() instanceof PrimitiveType or//基本类型
      sanitizer.getType() instanceof BoxedType or//基本类型的对象类型
      sanitizer.getType() instanceof NumberType or//数字类型
      exists(ParameterizedType pt| sanitizer.getType() = pt and pt.getTypeArgument(0) instanceof NumberType )  
     //判断是否是泛型类型并且其泛型参数是数字类型   
 }

/**
 * @id   java/examples/vuldemo
 * @name Sql-Injection
 * @description Sql-Injection
 * @kind path-problem
 * @problem.severity warning
 */

import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.QueryInjection

predicate isTaintedString(Expr expSrc, Expr expDest) {
    exists(Method method, MethodCall call, MethodCall call1|
           expSrc = call1.getArgument(0) and expDest = call and call.getMethod() = method
    and method.hasName("get") and method.getDeclaringType().toString() = "Optional<String>"
    and call1.getArgument(0).getType().toString() = "Optional<String>"
    )
}

module SqlInjectionConfig implements DataFlow::ConfigSig {
    predicate isSource(DataFlow::Node src) {
        src instanceof RemoteFlowSource
    }

    predicate isSink(DataFlow::Node sink) {
        exists(Method method, MethodCall call |
               method.hasName("query") and
               call.getMethod() = method and
        sink.asExpr() = call.getArgument(0)
        )
    }

    predicate isBarrier(DataFlow::Node sanitizer) {  // 4: 'isBarrier' replaces 'isSanitizer'
        sanitizer.getType() instanceof PrimitiveType or
        sanitizer.getType() instanceof BoxedType or
        sanitizer.getType() instanceof NumberType or
        exists(ParameterizedType pt| sanitizer.getType() = pt and pt.getTypeArgument(0) instanceof NumberType )  
    }
    predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
        isTaintedString(node1.asExpr(), node2.asExpr())
    }

}


module SqlFlow = TaintTracking::Global<SqlInjectionConfig>;


import SqlFlow::PathGraph

from SqlFlow::PathNode source, SqlFlow::PathNode sink
where SqlFlow::flowPath(source, sink)
select sink.getNode(), source, sink,
"Potential SQL-injection: user input flows to SQL query."

module SensitiveLoggerConfig implements DataFlow::ConfigSig {  // 1: module always implements DataFlow::ConfigSig or DataFlow::StateConfigSig
  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof CredentialExpr } // 3: no need to specify 'override'
  predicate isSink(DataFlow::Node sink) { sinkNode(sink, "log-injection") }

  predicate isBarrier(DataFlow::Node sanitizer) {  // 4: 'isBarrier' replaces 'isSanitizer'
    sanitizer.asExpr() instanceof LiveLiteral or
    sanitizer.getType() instanceof PrimitiveType or
    sanitizer.getType() instanceof BoxedType or
    sanitizer.getType() instanceof NumberType or
    sanitizer.getType() instanceof TypeType
  }

}

module SensitiveLoggerFlow = TaintTracking::Global<SensitiveLoggerConfig>; // 2: TaintTracking selected 

import SensitiveLoggerFlow::PathGraph  // 7: the PathGraph specific to the module you are using

from SensitiveLoggerFlow::PathNode source, SensitiveLoggerFlow::PathNode sink  // 8 & 9: using the module directly
where SensitiveLoggerFlow::flowPath(source, sink)  // 9: using the flowPath from the module 
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
  "potentially sensitive information"

#自定义规则扫描文件
import java

from RefType c
where c.hasName("XStreamHandler")
select c

import java

from RefType c,Callable cf
where 
  c.hasName("XStreamHandler") and
  cf.hasName("fromObject")and
  cf=c.getACallable()
select c,cf

##因为我这里git-commit-id-maven-plugin 插件报错，所以我这里强制跳过了
##生成数据库
codeql database create mybatis_3_db --language=java --command="mvn clean compile -Dgpg.skip=true -Dmaven.gitcommitid.skip=true" --source-root=D:\mybatis-3-master --overwrite
codeql database create mybatis_3_db --language=java --command="mvn clean compile -Dgpg.skip=true -Dmaven.gitcommitid.skip=true" --source-root=D:\text\java-sec-code-master --overwrite

/**
* @kind path-problem
*/

import java

class LookupMethod extends Call {
    LookupMethod() {
        this.getCallee().getDeclaringType().getASupertype*().hasQualifiedName("javax.naming", "Context") and
        this.getCallee().hasName("lookup")
    }
}


class GetterCallable extends Callable {
    GetterCallable() {
        getName().matches("get%") and
        hasNoParameters() and
        getName().length() > 3
        or
        getName().matches("set%") and
        getNumberOfParameters() = 1
    }
}


query predicate edges(Callable a, Callable b) { a.polyCalls(b) }

from LookupMethod endcall, GetterCallable entryPoint, Callable endCallAble
where
endcall.getCallee() = endCallAble and
edges+(entryPoint, endCallAble)
select endcall.getCaller(), entryPoint, endcall.getCaller(), "Geter jndi"

    * **第二部分匹配 setter：**

#拉取一个ubuntu 16.04镜像
docker pull ubuntu:16.04
# 使用镜像并且进入容器
docker run -it ubuntu:16.04 /bin/bash
#更新软件源
apt-get update
# 下载必要构建工具
apt install -y build-essential gdb  cmake openjdk-8-jdk cpio file unzip zip wget
apt install -y --no-install-recommends  libfontconfig1-dev libfreetype6-dev  libcups2-dev libx11-dev  libxext-dev  libxrender-dev  libxrandr-dev  libxtst-dev  libxt-dev libasound2-dev  libffi-dev  autoconf
# 降级 Make
wget http://ftp.gnu.org/gnu/make/make-3.81.tar.gz 
  && tar -zxvf make-3.81.tar.gz 
  && cd /make-3.81 
  && bash configure -prefix=/usr 
  && make 
  && make install
  

#获取jdk源码
apt-get update && apt-get install -y git
git clone https://github.com/openjdk/jdk8u.git
#进入jdk源码目录
cd jdk8u
#运行configure进行编译配置和编译环境检查
bash configure --with-debug-level=fastdebug  \
   --with-jvm-variants=server  \
   --with-boot-jdk=/usr/lib/jvm/java-1.8.0-openjdk-amd64 \
   --with-target-bits=64 \
   --enable-debug-symbols  \
   --with-native-debug-symbols=internal

make images JOBS=4

wget https://github.com/github/codeql-cli-binaries/releases/download/v2.14.6/codeql-linux64.zip
unzip codeql-linux64.zip -d /oopt
# 添加到PATH
export PATH=$PATH:/oopt/codeql

cd /jdk8u

codeql database create openjdk8u-db \
  --language=java \
  --command="make images JOBS=4" \
  --source-root=.

@Component
public class PdfGeneratorUtil {

    private final SpringTemplateEngine templateEngine;
    private final String baseUrl;

    public PdfGeneratorUtil(SpringTemplateEngine templateEngine, @Value("${base.url}") String baseUrl) {
        this.templateEngine = templateEngine;
        this.baseUrl = baseUrl;
    }

    public File generatePdfFromInvoice(Invoice invoice) {

        Context ctx = new Context();
        ctx.setVariable("invoice", invoice);
        String processedHtml = templateEngine.process("email/pdf/invoice", ctx);

        ITextRenderer renderer = new ITextRenderer();
        renderer.setDocumentFromString(processedHtml, baseUrl);
        renderer.layout();

        String fileName = UUID.randomUUID().toString();
        FileOutputStream os = null;
        try {
            final File outputFile = File.createTempFile(fileName, ".pdf");
            os = new FileOutputStream(outputFile);
            renderer.createPDF(os, false);
            renderer.finishPDF();
            return outputFile;
        } catch (FileNotFoundException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        } catch (DocumentException e) {
            e.printStackTrace();
        } finally {
            if (os != null) {
                try {
                    os.close();

                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        return null;
    }

}