CVE-2013-7285-query.ql

/**
 * @name XStream deserialization without security framework - Internal method tracking
 * @description Tracks internal XStream method calls that lack security validation in vulnerable versions.
 * @problem.severity error
 * @security-severity 9.8
 * @precision high
 * @tags security
 * @kind path-problem
 * @id java/xstream-unsafe-deserialization-internal
 */

import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.ExternalFlow

class Source extends DataFlow::Node {
  Source() {
    // Internal method calls in XStream mapper chain
    exists(MethodCall ma |
      (
        // CachingMapper.realClass method calls
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream.mapper", "CachingMapper") and
        ma.getMethod().hasName("realClass")
        or
        // XStream internal setup methods
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
        ma.getMethod().hasName(["setupAliases", "buildMapperDynamically", "buildMapper"])
        or
        // FileConverter method calls
        ma.getMethod().getDeclaringType().hasName("FileConverter") and
        ma.getMethod().hasName("flushCache")
        or
        // Mapper chain method calls
        exists(Method m | m = ma.getMethod() |
          m.getDeclaringType().getPackage().hasName("com.thoughtworks.xstream.mapper") and
          m.hasName(["realClass", "mapperOfType", "lookupMapperOfType"])
        )
        or
        // XStream deserialization entry points
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
        ma.getMethod().hasName(["fromXML", "unmarshal"])
      ) and
      this.asExpr() = ma
    )
    or
    // Arguments to internal methods that handle class resolution
    exists(MethodCall ma |
      (
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream.mapper", "CachingMapper") and
        ma.getMethod().hasName("realClass")
        or
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
        ma.getMethod().hasName(["setupAliases", "buildMapperDynamically"])
      ) and
      this.asExpr() = ma.getAnArgument()
    )
    or
    // Active threat model sources for completeness
    this instanceof ActiveThreatModelSource
  }
}

class Sink extends DataFlow::Node {
  Sink() {
    // Internal method calls that perform unsafe operations in vulnerable versions
    exists(MethodCall ma |
      (
        // CachingMapper.realClass without security validation
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream.mapper", "CachingMapper") and
        ma.getMethod().hasName("realClass") and
        not hasSecurityValidation(ma)
        or
        // XStream setup methods that don't configure security
        ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
        ma.getMethod().hasName(["setupAliases", "buildMapperDynamically", "buildMapper"]) and
        not hasSecurityMapperInChain(ma)
        or
        // FileConverter methods without validation
        ma.getMethod().getDeclaringType().hasName("FileConverter") and
        ma.getMethod().hasName("flushCache")
      ) and
      this.asExpr() = ma
    )
  }
}

predicate hasSecurityValidation(MethodCall ma) {
  // Check if SecurityMapper is present in the compilation unit
  exists(ImportType imp |
    imp.getImportedType().hasQualifiedName("com.thoughtworks.xstream.mapper", "SecurityMapper") and
    imp.getCompilationUnit() = ma.getEnclosingCallable().getDeclaringType().getCompilationUnit()
  )
  or
  // Check if TypePermission classes are imported (indicating security framework usage)
  exists(ImportType imp |
    imp.getImportedType().getPackage().hasName("com.thoughtworks.xstream.security") and
    imp.getCompilationUnit() = ma.getEnclosingCallable().getDeclaringType().getCompilationUnit()
  )
  or
  // Check for SecurityMapper field in the class
  exists(Field f |
    f.getDeclaringType() = ma.getEnclosingCallable().getDeclaringType() and
    f.hasName("securityMapper") and
    f.getType().(RefType).hasQualifiedName("com.thoughtworks.xstream.mapper", "SecurityMapper")
  )
}

predicate hasSecurityMapperInChain(MethodCall ma) {
  // Check if SecurityMapper is configured in the mapper chain
  exists(ClassInstanceExpr cie |
    cie.getConstructedType().hasQualifiedName("com.thoughtworks.xstream.mapper", "SecurityMapper") and
    cie.getEnclosingCallable() = ma.getEnclosingCallable()
  )
  or
  // Check if security imports are present
  hasSecurityValidation(ma)
  or
  // Check if setupSecurity method has been called
  exists(MethodCall setupCall |
    setupCall.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
    setupCall.getMethod().hasName("setupSecurity") and
    setupCall.getEnclosingCallable() = ma.getEnclosingCallable()
  )
}

class Sanitizer extends DataFlow::Node {
  Sanitizer() {
    // SecurityMapper validation calls
    exists(MethodCall ma |
      ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream.mapper", "SecurityMapper") and
      ma.getMethod().hasName("realClass") and
      this.asExpr() = ma
    )
    or
    // TypePermission validation
    exists(MethodCall ma |
      ma.getMethod().getDeclaringType().getPackage().hasName("com.thoughtworks.xstream.security") and
      (ma.getMethod().hasName("allows") or ma.getMethod().hasName("implies")) and
      this.asExpr() = ma
    )
    or
    // XStream security setup methods
    exists(MethodCall ma |
      ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
      ma.getMethod().hasName(["setupSecurity", "addPermission"]) and
      this.asExpr() = ma
    )
    or
    // SecurityMapper constructor (creating security validation layer)
    exists(ClassInstanceExpr cie |
      cie.getConstructedType().hasQualifiedName("com.thoughtworks.xstream.mapper", "SecurityMapper") and
      this.asExpr() = cie
    )
  }
}

module MyPathConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source instanceof Source }

  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof Sanitizer }

  predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
    // Flow through internal mapper chain calls
    exists(MethodCall ma |
      ma.getMethod().getDeclaringType().getPackage().hasName("com.thoughtworks.xstream.mapper") and
      n1.asExpr() = ma.getAnArgument() and
      n2.asExpr() = ma
    )
    or
    // Flow through XStream internal setup methods
    exists(MethodCall ma |
      ma.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
      ma.getMethod().hasName(["setupAliases", "buildMapperDynamically", "buildMapper"]) and
      n1.asExpr() = ma.getAnArgument() and
      n2.asExpr() = ma
    )
    or
    // Flow from XStream deserialization to internal methods
    exists(MethodCall ma1, MethodCall ma2 |
      ma1.getMethod().getDeclaringType().hasQualifiedName("com.thoughtworks.xstream", "XStream") and
      ma1.getMethod().hasName(["fromXML", "unmarshal"]) and
      ma2.getMethod().getDeclaringType().getPackage().hasName("com.thoughtworks.xstream.mapper") and
      DataFlow::localFlow(DataFlow::exprNode(ma1), DataFlow::exprNode(ma2.getQualifier())) and
      n1.asExpr() = ma1 and
      n2.asExpr() = ma2
    )
  }
}

module MyPathFlow = TaintTracking::Global<MyPathConfig>;

import MyPathFlow::PathGraph

from MyPathFlow::PathNode source, MyPathFlow::PathNode sink
where MyPathFlow::flowPath(source, sink)
select sink.getNode(), source, sink,
  "Internal XStream method call without security validation allows unsafe class resolution.",
  source.getNode(), "unsafe internal method call"