https://github.com/github/codeql/blob/main/docs/ql-style-guide.md

    image.png

    image.png

    https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNG.ql

    1. /**
    2.  * @name Detect JHipster Generator Vulnerability CVE-2019-16303
    3.  * @description Using a vulnerable version of JHipster to generate random numbers makes it easier for attackers to take over accounts.
    4.  * @kind problem
    5.  * @problem.severity error
    6.  * @security-severity 7.8
    7.  * @precision very-high
    8.  * @id java/jhipster-prng
    9.  * @tags security
    10.  *       external/cwe/cwe-338
    11.  */
    13. import java
    14. import semmle.code.java.frameworks.apache.Lang
    16. private class PredictableApacheRandomStringUtilsMethod extends Method {
    17.   PredictableApacheRandomStringUtilsMethod() {
    18.     this.getDeclaringType() instanceof TypeApacheRandomStringUtils and
    19.     // The one valid use of this type that uses SecureRandom as a source of data.
    20.     not this.getName() = "random"
    21.   }
    22. }
    24. private class PredictableApacheRandomStringUtilsMethodAccess extends MethodAccess {
    25.   PredictableApacheRandomStringUtilsMethodAccess() {
    26.     this.getMethod() instanceof PredictableApacheRandomStringUtilsMethod
    27.   }
    28. }
    30. private class VulnerableJHipsterRandomUtilClass extends Class {
    31.   VulnerableJHipsterRandomUtilClass() {
    32.     // The package name that JHipster generated the 'RandomUtil' class in was dynamic. Thus 'hasQualifiedName' can not be used here.
    33.     getName() = "RandomUtil"
    34.   }
    35. }
    37. private class VulnerableJHipsterRandomUtilMethod extends Method {
    38.   VulnerableJHipsterRandomUtilMethod() {
    39.     this.getDeclaringType() instanceof VulnerableJHipsterRandomUtilClass and
    40.     this.getName().matches("generate%") and
    41.     this.getReturnType() instanceof TypeString and
    42.     exists(ReturnStmt s |
    43.       s = this.getBody().(SingletonBlock).getStmt() and
    44.       s.getResult() instanceof PredictableApacheRandomStringUtilsMethodAccess
    45.     )
    46.   }
    47. }
    49. from VulnerableJHipsterRandomUtilMethod method
    50. select method,
    51.   "Weak random number generator used in security sensitive method (JHipster CVE-2019-16303)."