/**

* @name Race condition in socket authentication

* @description Opening a socket after authenticating via a different channel may allow an attacker to connect to the port first.

* @kind problem

* @problem.severity warning

* @security-severity 7.2

* @precision medium

* @id java/socket-auth-race-condition

* @tags security

* external/cwe/cwe-421

*/

import java

import semmle.code.java.security.SensitiveActions

import semmle.code.java.controlflow.Dominance

import semmle.code.java.controlflow.Guards

abstract class ConnectionMethod extends Method { }

/*

* Amongst the Java networking utilities, the `ServerSocket*` classes allow listening on a port.

* By contrast, the `Socket*` classes require connection to a specific address.

*

* Listening (server) sockets are much more vulnerable to an unexpected user taking the connection,

* as the connection is initiated by the user. It would be possible to implement this attack on client

* socket connections, but this would require MITM-ing the connection between the authentication of the

* server and the opening of the alternate channel, which seems quite tricky.

*/

/**

* The `accept` method on `ServerSocket`, which listens for a connection and returns when one has

* been established.

*/

class ServerSocketAcceptMethod extends ConnectionMethod {

ServerSocketAcceptMethod() {

this.getName() = "accept" and

this.getDeclaringType().hasQualifiedName("java.net", "ServerSocket")

}

}

/**

* The `accept` method on `ServerSocketChannel`, which listens for a connection and returns when one has

* been established.

*/

class ServerSocketChannelAcceptMethod extends ConnectionMethod {

ServerSocketChannelAcceptMethod() {

this.getName() = "accept" and

this.getDeclaringType().hasQualifiedName("java.nio.channels", "ServerSocketChannel")

}

}

predicate controlledByAuth(Expr controlled, Expr condition) {

exists(ConditionBlock b |

condition = b.getCondition() and

b.controls(controlled.getBasicBlock(), _) and

condition.(MethodCall).getMethod() instanceof AuthMethod

)

}

/*

* The approach here is to look for connections where the opening

* of the connection is guarded by an authentication check.

* While this is not exactly what we want to look for (we want to

* look for the absence of authentication over the new channel):

* - If you are authenticating over the new channel, then there is

* little point in authenticating again beforehand. So we can

* assume that these cases are likely to be disjoint.

* - Spotting something that looks like an authentication check is

* a heuristic that tells us that this connection is meant to be

* authenticated. If we checked every connection, we would have

* no idea which ones were meant to be secure.

*/

from MethodCall connection, Expr condition

where

connection.getMethod() instanceof ConnectionMethod and

controlledByAuth(connection, condition)

select connection,

"This connection occurs after the authentication in $@, rather than authentication over the new connection.",

condition, "this condition"