EjbSecurityConfiguration.ql

/**
 * @name EJB accesses security configuration
 * @description An EJB should not attempt to access or modify any Java security configuration,
 *              including the Policy, Security, Provider, Signer and Identity objects.
 *              This functionality is reserved for the EJB container for security reasons.
 * @kind problem
 * @problem.severity error
 * @precision low
 * @id java/ejb/security-configuration-access
 * @tags external/cwe/cwe-573
 */
import java
import semmle.code.java.frameworks.javaee.ejb.EJB
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions

/*
JSR 220: Enterprise JavaBeansTM,Version 3.0
EJB Core Contracts and Requirements
Section 21.1.2 Programming Restrictions

- The enterprise bean must not attempt to obtain the security policy information for a particular
code source.

Allowing the enterprise bean to access the security policy information would create a security hole.

- The enterprise bean must not attempt to access or modify the security configuration objects
(Policy, Security, Provider, Signer, and Identity).

These functions are reserved for the EJB container. Allowing the enterprise bean to use these functions
could compromise security.
*/

from Callable origin, ForbiddenSecurityConfigurationCallable target, Call call
where ejbCalls(origin, target, call)
select origin, "EJB should not access a security configuration by calling $@.",
  call, target.getDeclaringType().getName() + "." + target.getName()