Using Labels for Tainttracking in Java

[reichef]

Hello,

i am new to CodeQL and want to perform a Lattice-based Taintanalysis with custom Labels in Java.
Essentially, i want to declare methods and their parameters or returns with custom labels to represent some security level, e.g., "high" and "low", and want to detect if there are flows between data labeled with high to data labeled with low.

Therefore i have to following Requirements:

1. Declaring Parameters or Results("Returns") in Methods of Classes specific classes as Sources or Sinks.
2. Specify Labels for them
3. Specify a lattice, i.e., which flows are allowed or not allowed

First Question: Is CodeQL able to perform an analysis with these requirements? If no, the following can be skipped.

Currently i can specify really basic dataflow and tainttracking queries according to the tutorial https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-java/.

However, i do not really find a tutorial how to define and attach the "Labels" for Data in Java.
I already thought DataFlow::FlowState and DataFlow::StateConfigSig does the trick and are similar to Flow Labels in CodeQL for Javascript as shown in the tutorial https://codeql.github.com/docs/codeql-language-guides/using-flow-labels-for-precise-data-flow-analysis/.

Second Question: Can the FlowState be used for labeling Data and analyzing flows with it? If no, what is the suitable means for this.
In case of no, the following can be skipped.

I have several problems/questions with FlowState and FlowStateConfigSig

1. Using StateConfigSig requires me to "Declare FlowState", however i do not know what this means on the configuration level. What do i have to specify here?
2. I do not know how to define the FlowState/Label for specific data to start with. Is there some tutorial i did not find or could you help me here?
3. I would like to query the FlowState, however, i do not find anyway to access it. Whats the right way to obtain the current FlowState of a Node or similar?
4. With the StateConfigSig isSource/isSink requires the definition of a subclass of FlowState. However, i would like to keep the query dynamic so the sources or sinks i want to select can be dynamically specified. A workaround would be to provide a custom FlowState for this which then is extended by other classes. Is there another way for doing this?

Can you help me with these problems/problems as well?

Sorry for the long text and thanks for the help in advance.

[aibaars]

This is a very interesting question. I'm not entirely sure if flow states are really necessary in your use-case. Couldn't you mark all high security data as sources and places with low security as sinks and do a normal state-less taint flow analysis to see if there is flow between the sources and the sinks?

You might still want to explore using FlowStates. For experimenting a bit with FlowStates, I think you could define class FlowState = string and use some string contants as flow labels. Flow states are rarely used in the queries in github/codeql, but in cases where they are used the FlowState class is typially defined as a newtype. See for example:

codeql/java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll

Lines 30 to 33 in 67019c6

	private newtype ActionState =
	ActionUnset() or
	HasInstallPackageAction()

You can "set" the state of a bit of data at the source by defining an isSource(Node, FlowState) predicate. Most default taint steps will be state preserving, you can define your own additional taint steps that change the state, or restrict the permitted states by defining a predicate

 predicate isAdditionalFlowStep(
    DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2

A state preserving step would have state1 = state2 in its definition, a state-changing step could have for example state1 = "high" and state2 = "low" to denote that this step convert secure to insecure data.

[reichef]

Hi,

thank you for your answer and the examples in advance. I will try to use it to analyze my use-case.

Just for clarification: i'm sorry - i've now seen that i did not make my use-case entirely clear. What i really want to analyze/support are use-cases which use more than two labels and, in general, whether unallowed flows exist between them.

Lets take this example.
We have three parties in a system: a User, a Travel Agency and an Airline, which build the basic labels. Certain Data is intended to be accessed only by one or more of these parties. Therefore, we have to combine the basic labels.
Within a predicate, we define which flows are allowed or not allowed by specifying combinations of labels (a flow-lattice).

This led to my question w.r.t. attaching the labels in advance to data. Because this would allow me to query:
Find all flows between sources and sinks, where the corresponding program parts have labels which are not allowed based on my lattice/predicate/policy.