Skip to content

Commit dda042f

Browse files
mbaludambaluda
committed
rename change notes
1 parent 0464e64 commit dda042f

File tree

5 files changed

+87
-60
lines changed

5 files changed

+87
-60
lines changed

‎java/ql/lib/ext/com.couchbase.client.core.env.model.yml‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,26 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["com.couchbase.client.core.env", "CertificateAuthenticator", true, "fromKey", "(PrivateKey,String,List)", "", "Argument[0]", "credentials-key", "manual"]
6+
# 'credentials-password' sinks
77
- ["com.couchbase.client.core.env", "CertificateAuthenticator", true, "fromKey", "(PrivateKey,String,List)", "", "Argument[1]", "credentials-password", "manual"]
8-
- ["com.couchbase.client.core.env", "CertificateAuthenticator", true, "fromKeyStore", "(Path,String,Optional<String>)", "", "Argument[1]", "credentials-password", "manual"]
8+
- ["com.couchbase.client.core.env", "CertificateAuthenticator", true, "fromKeyStore", "(Path,String,Optional)", "", "Argument[1]", "credentials-password", "manual"]
99
- ["com.couchbase.client.core.env", "CertificateAuthenticator", true, "fromKeyStore", "(KeyStore,String)", "", "Argument[1]", "credentials-password", "manual"]
10-
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "username", "(String)", "", "Argument[0]", "credentials-username", "manual"]
11-
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "username", "(Supplier<String>)", "", "Argument[0]", "credentials-username", "manual"]
10+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "create", "(String,String)", "", "Argument[1]", "credentials-password", "manual"]
11+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "ldapCompatible", "(String,String)", "", "Argument[1]", "credentials-password", "manual"]
12+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "builder", "(String,String)", "", "Argument[1]", "credentials-password", "manual"]
13+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "builder", "(Supplier)", "", "Argument[0]", "credentials-password", "manual"]
1214
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "password", "(String)", "", "Argument[0]", "credentials-password", "manual"]
15+
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "password", "(Supplier)", "", "Argument[0]", "credentials-password", "manual"]
16+
# 'credentials-username' sinks
17+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "create", "(String,String)", "", "Argument[0]", "credentials-username", "manual"]
18+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "ldapCompatible", "(String,String)", "", "Argument[0]", "credentials-username", "manual"]
19+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "builder", "(String,String)", "", "Argument[0]", "credentials-username", "manual"]
20+
- ["com.couchbase.client.core.env", "PasswordAuthenticator", true, "builder", "(Supplier)", "", "Argument[0]", "credentials-username", "manual"]
21+
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "username", "(String)", "", "Argument[0]", "credentials-username", "manual"]
22+
- ["com.couchbase.client.core.env", "PasswordAuthenticator$Builder", true, "username", "(Supplier)", "", "Argument[0]", "credentials-username", "manual"]
23+
24+
- addsTo:
25+
pack: codeql/java-all
26+
extensible: summaryModel
27+
data:
28+
- ["com.couchbase.client.core.env", "UsernameAndPassword", true, "UsernameAndPassword", "(String,String)", "", "Argument[0..1]", "Argument[this]", "taint", "manual"]

‎java/ql/lib/ext/com.couchbase.client.java.model.yml‎

Lines changed: 11 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,26 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["com.couchbase.client.java", "ClusterOptions", true, "clusterOptions", "(String,String)", "", "Argument[0]", "credentials-username", "manual"]
7-
- ["com.couchbase.client.java", "ClusterOptions", true, "clusterOptions", "(String,String)", "", "Argument[1]", "credentials-password", "manual"]
6+
# 'credentials-username' sinks
87
- ["com.couchbase.client.java", "Cluster", true, "connect", "(String,String,String)", "", "Argument[1]", "credentials-username", "manual"]
8+
- ["com.couchbase.client.java", "ClusterOptions", true, "clusterOptions", "(String,String)", "", "Argument[0]", "credentials-username", "manual"]
9+
# 'credentials-password' sinks
910
- ["com.couchbase.client.java", "Cluster", true, "connect", "(String,String,String)", "", "Argument[2]", "credentials-password", "manual"]
10-
- ["com.couchbase.client.java", "Cluster", true, "query", "(String)", "", "Argument[0]", "sql-injection", "manual"]
11-
- ["com.couchbase.client.java", "Cluster", true, "query", "(String,QueryOptions)", "", "Argument[0]", "sql-injection", "manual"]
11+
- ["com.couchbase.client.java", "ClusterOptions", true, "clusterOptions", "(String,String)", "", "Argument[1]", "credentials-password", "manual"]
12+
# 'sql-injection' sinks
1213
- ["com.couchbase.client.java", "Cluster", true, "analysticsQuery", "(String)", "", "Argument[0]", "sql-injection", "manual"]
1314
- ["com.couchbase.client.java", "Cluster", true, "analysticsQuery", "(String,AnalyticsOptions)", "", "Argument[0]", "sql-injection", "manual"]
14-
- ["com.couchbase.client.java", "Cluster", true, "queryStreaming", "(String,Consumer<QueryRow>)", "", "Argument[0]", "sql-injection", "manual"]
15-
- ["com.couchbase.client.java", "Cluster", true, "queryStreaming", "(String,QueryOptions,Consumer<QueryRow>)", "", "Argument[0]", "sql-injection", "manual"]
15+
- ["com.couchbase.client.java", "Cluster", true, "query", "(String)", "", "Argument[0]", "sql-injection", "manual"]
16+
- ["com.couchbase.client.java", "Cluster", true, "query", "(String,QueryOptions)", "", "Argument[0]", "sql-injection", "manual"]
17+
- ["com.couchbase.client.java", "Cluster", true, "queryStreaming", "(String,Consumer)", "", "Argument[0]", "sql-injection", "manual"]
18+
- ["com.couchbase.client.java", "Cluster", true, "queryStreaming", "(String,QueryOptions,Consumer)", "", "Argument[0]", "sql-injection", "manual"]
1619
- ["com.couchbase.client.java", "Cluster", true, "searchQuery", "(String,SearchQuery)", "", "Argument[1]", "sql-injection", "manual"]
1720
- ["com.couchbase.client.java", "Cluster", true, "searchQuery", "(String,SearchQuery,SearchOptions)", "", "Argument[1]", "sql-injection", "manual"]
18-
- ["com.couchbase.client.java", "Collection", true, "upsert", "(String,Object)", "", "Argument[1]", "sql-injection", "manual"]
19-
- ["com.couchbase.client.java", "Collection", true, "upsert", "(String,Object,UpsertOptions)", "", "Argument[1]", "sql-injection", "manual"]
20-
- ["com.couchbase.client.java", "Collection", true, "replace", "(String,Object)", "", "Argument[1]", "sql-injection", "manual"]
21-
- ["com.couchbase.client.java", "Collection", true, "replace", "(String,Object,ReplaceOptions)", "", "Argument[1]", "sql-injection", "manual"]
2221

2322
- addsTo:
2423
pack: codeql/java-all
2524
extensible: summaryModel
2625
data:
27-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
28-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,Object)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
29-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
30-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,String)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
31-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
32-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,long)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
33-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,number)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
34-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,double)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
35-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,boolean)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
36-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,JsonObject)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
37-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,JsonObject)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
38-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,Map)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
39-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,Map)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
40-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,JsonArray)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
41-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,JsonArray)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
42-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,List)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
43-
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "(String,List)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
26+
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "", "", "Argument[0]", "ReturnValue.MapKey", "taint", "manual"]
27+
- ["com.couchbase.client.java.json", "JsonObject", true, "put", "", "", "Argument[1]", "ReturnValue.MapValue", "taint", "manual"]
4428
- ["com.couchbase.client.java.json", "JsonObject", true, "putNull", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCouchBaseCredentials.java‎

Lines changed: 43 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,53 @@
11
import static com.couchbase.client.java.ClusterOptions.clusterOptions;
22

3-
import com.couchbase.client.core.env.Authenticator;
43
import com.couchbase.client.core.env.CertificateAuthenticator;
54
import com.couchbase.client.core.env.PasswordAuthenticator;
5+
import com.couchbase.client.core.env.UsernameAndPassword;
66
import com.couchbase.client.java.Cluster;
7+
import java.util.function.Supplier;
78

89
public class HardcodedCouchBaseCredentials {
910
public static void test() {
10-
Cluster cluster1 =
11-
Cluster.connect(
12-
"127.0.0.1",
13-
"Administrator", // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
14-
"password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
15-
Cluster cluster2 =
16-
Cluster.connect(
17-
"127.0.0.1",
18-
clusterOptions(
19-
"Administrator", // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
20-
"password")); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
21-
PasswordAuthenticator authenticator1 =
22-
PasswordAuthenticator.builder()
23-
.username(
24-
"Administrator") // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
25-
.password("password") // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
26-
.onlyEnablePlainSaslMechanism()
27-
.build();
11+
// com.couchbase.client.core.env.CertificateAuthenticator sinks
12+
CertificateAuthenticator.fromKey(null, "keyPassword", null); // $ HardcodedCredentialsApiCall
13+
CertificateAuthenticator.fromKeyStore(
14+
null, "keyStorePassword", null); // $ HardcodedCredentialsApiCall
15+
CertificateAuthenticator.fromKeyStore(
16+
null, "keyStorePassword"); // $ HardcodedCredentialsApiCall
2817

29-
Authenticator authenticator2 =
30-
CertificateAuthenticator.fromKeyStore(
31-
null,
32-
"keyStorePassword"); // $ HardcodedCredentialsApiCall
33-
Cluster cluster = Cluster.connect("127.0.0.1", clusterOptions(authenticator2));
18+
// com.couchbase.client.core.env.PasswordAuthenticator sinks
19+
PasswordAuthenticator.create(
20+
"Administrator", // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
21+
"password"); // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
22+
PasswordAuthenticator.ldapCompatible(
23+
"Administrator", // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
24+
"password"); // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
25+
26+
// com.couchbase.client.core.env.PasswordAuthenticator$Builder sinks
27+
PasswordAuthenticator.builder(
28+
"Administrator", // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
29+
"password"); // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
30+
PasswordAuthenticator.builder()
31+
.username("Administrator") // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
32+
.password("password"); // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
33+
PasswordAuthenticator.builder((Supplier<UsernameAndPassword>) new UsernameAndPassword(
34+
"Administrator", // $ HardcodedCredentialsSourceCall$ MISSING: HardcodedCredentialsApiCall
35+
"password")); // $ HardcodedCredentialsSourceCall$ MISSING: HardcodedCredentialsApiCall
36+
PasswordAuthenticator.builder()
37+
.username((Supplier<String>) () -> {return "Administrator";}) // $ MISSING: HardcodedCredentialsApiCall
38+
.password((Supplier<String>) () -> {return "password";}); // $ MISSING: HardcodedCredentialsApiCall
39+
40+
// com.couchbase.client.java.Cluster sinks
41+
Cluster.connect(
42+
"127.0.0.1",
43+
"Administrator", // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
44+
"password"); // $ HardcodedCredentialsSourceCall $ HardcodedCredentialsApiCall
45+
46+
// com.couchbase.client.java.ClusterOptions sinks
47+
Cluster.connect(
48+
"127.0.0.1",
49+
clusterOptions(
50+
"Administrator", // $ HardcodedCredentialsApiCall
51+
"password")); // $ HardcodedCredentialsApiCall
3452
}
35-
}
53+
}

‎java/ql/test/stubs/couchbaseClient/com/couchbase/client/core/env/PasswordAuthenticator.java‎

Lines changed: 10 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/couchbaseClient/com/couchbase/client/core/env/UsernameAndPassword.java‎

Lines changed: 3 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)