This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/master by this push:
new 1264c20c69 TODO-240: Add CodeQL barrierModel for
FileUtils.resolveSafely path-injection sanitizer
1264c20c69 is described below
commit 1264c20c69fc24e56af84ea8ee2c5d9e67e9fd57
Author: James Bognar <[email protected]>
AuthorDate: Tue Jul 14 17:31:31 2026 -0400
TODO-240: Add CodeQL barrierModel for FileUtils.resolveSafely
path-injection sanitizer
Teaches CodeQL's java/path-injection query that FileUtils.resolveSafely(...)
and FileUtils.resolveVirtualPathSafely(...) are genuine cross-method
sanitizers, so their return values (and, for the Optional-returning
overload, the unwrapped element) are treated as boundary-checked rather
than re-flagged at every call site (see FINISHED-235 alerts #91, #93,
#321-#328, and the TODO-236 relocation re-spawn of #322-#328).
Also bumps github/codeql-action/init and .../analyze from 3.29.5 to 3.37.0
(CodeQL CLI 2.26.0), since barrierModel support requires CodeQL >= 2.25.2,
and wires the new local model pack into the analyze step via
CODEQL_ACTION_EXTRA_OPTIONS (--additional-packs / --extension-packs),
since unpublished local packs can't be loaded through codeql-config.yml's
packs: field.
Co-authored-by: Cursor <[email protected]>
---
.../models/path-injection.yml | 49 ++++++++++++++++++++++
.../apache/juneau-security-models/qlpack.yml | 34 +++++++++++++++
.github/workflows/codeql-analysis.yml | 6 ++-
3 files changed, 87 insertions(+), 2 deletions(-)
diff --git
a/.github/codeql/apache/juneau-security-models/models/path-injection.yml
b/.github/codeql/apache/juneau-security-models/models/path-injection.yml
new file mode 100644
index 0000000000..79c4639e3c
--- /dev/null
+++ b/.github/codeql/apache/juneau-security-models/models/path-injection.yml
@@ -0,0 +1,49 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# `barrierModel` rows (CodeQL >= 2.25.2) that tell the java/path-injection
query
+# family to stop taint tracking at the return value of juneau's path-boundary
+# funnel, org.apache.juneau.commons.utils.FileUtils.
+#
+# Background (TODO-240): FileUtils.resolveSafely(root, userPath) resolves a
+# user-supplied path against a root directory, rejecting
(IllegalArgumentException)
+# any target that escapes the root -- via `../`, absolute-path injection, or a
+# symlink pointing outside the root -- and returns Optional.empty() only when
the
+# (already-boundary-checked) target does not exist. It is a genuine
cross-method
+# sanitizer, but CodeQL's stock java/path-injection query has no way to know
that
+# without this model, so every reachable call site had to be manually
dismissed as
+# a false positive (see
.work/todo/finished/FINISHED-235-codeql-security-alert-remediation.md,
+# alerts #91, #93, #321-#328) -- and those dismissals don't survive a file
move, as
+# proven by TODO-236 re-spawning #322-#328 under fresh ids.
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: barrierModel
+ checkPresence: false # tolerate CLI/bundle versions that predate
barrierModel (< 2.25.2)
+ data:
+ # FileUtils.resolveSafely(File rootDir, String userPath) ->
Optional<File>
+ #
(juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/utils/FileUtils.java:286)
+ # The boundary-checked File lives inside the returned Optional's
element, so both
+ # the plain ReturnValue and its unwrapped ".Element" are modeled as
barriers -- the
+ # latter is what actually matters once a caller unwraps via
Optional#get/orElse/etc.,
+ # since CodeQL's own java.util.model.yml summarizes those as
+ # `Argument[this].Element -> ReturnValue` (value-preserving).
+ - ["org.apache.juneau.commons.utils", "FileUtils", False,
"resolveSafely", "(File,String)", "", "ReturnValue", "path-injection", "manual"]
+ - ["org.apache.juneau.commons.utils", "FileUtils", False,
"resolveSafely", "(File,String)", "", "ReturnValue.Element", "path-injection",
"manual"]
+ # FileUtils.resolveVirtualPathSafely(String basePath, String userPath)
-> String
+ #
(juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/utils/FileUtils.java:345)
+ # Virtual-path variant; returns a plain (already boundary-checked)
String, no
+ # Optional wrapper, so only the bare ReturnValue access path applies.
+ - ["org.apache.juneau.commons.utils", "FileUtils", False,
"resolveVirtualPathSafely", "(String,String)", "", "ReturnValue",
"path-injection", "manual"]
diff --git a/.github/codeql/apache/juneau-security-models/qlpack.yml
b/.github/codeql/apache/juneau-security-models/qlpack.yml
new file mode 100644
index 0000000000..386adc9757
--- /dev/null
+++ b/.github/codeql/apache/juneau-security-models/qlpack.yml
@@ -0,0 +1,34 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# CodeQL model pack (data-extension only, no queries/dependencies) that
teaches the
+# standard `codeql/java-all` query pack about juneau's own path-traversal
sanitizer
+# funnel, `FileUtils.resolveSafely(...)` /
`FileUtils.resolveVirtualPathSafely(...)`.
+#
+# This is a *local* model pack -- it is not published to a registry. It is
loaded by
+# the CodeQL Action via the `--additional-packs` / `--extension-packs` CLI
flags set
+# through `CODEQL_ACTION_EXTRA_OPTIONS` on the analyze step in
+# `.github/workflows/codeql-analysis.yml` (see the comment there for why the
+# `packs:` field in a codeql-config.yml cannot be used for unpublished local
packs).
+#
+# See TODO-240 (.work/todo/TODO-240-codeql-resolvesafely-sanitizer-model.md)
for the
+# motivating context.
+name: apache/juneau-security-models
+version: 0.0.1
+library: true
+extensionTargets:
+ codeql/java-all: "*"
+dataExtensions:
+ - models/**/*.yml
diff --git a/.github/workflows/codeql-analysis.yml
b/.github/workflows/codeql-analysis.yml
index 555eef6ece..01b6cc5e1d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
# 3.29.5
+ uses: github/codeql-action/init@e5d2f324924c57b6cabef9bdd7a1c85d62a89be2
# 3.37.0
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a
config file.
@@ -81,4 +81,6 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses:
github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #
3.29.5
+ uses:
github/codeql-action/analyze@e5d2f324924c57b6cabef9bdd7a1c85d62a89be2 #
3.37.0
+ env:
+ CODEQL_ACTION_EXTRA_OPTIONS:
'{"database":{"run-queries":["--additional-packs=${{ github.workspace
}}/.github/codeql","--extension-packs=apache/juneau-security-models"]}}'
\ No newline at end of file
