[Java] CWE-078: Add JSch lib OS Command Injection sink

[p0wn4j]

JSch is a pure Java implementation of SSH2. JSch allows you to connect to a sshd server and use port forwarding, X11 forwarding, file transfer, command execution, etc.
If an attacker can control the command that is going to be executed on a sshd server, it can lead an attacker to Remote Code Execution on that server.

Code example:

JSch jsch = new JSch();
...
Session session = jsch.getSession(user, host, 22);
...
session.connect();
Channel channel = session.openChannel("exec");
((ChannelExec) channel).setCommand(controlledCommand);
channel.connect();
...

Found hits on these repos:
https://github.com/KingLai23/Puzzle
https://github.com/manuelacalvo/DATATourisme
https://github.com/jack775544/jTransfer

[owen-mc]

You can simplify by making setCommand the sink. I can't think of any good reason why code would call setCommand apart from that they intend to call connect soon afterwards.

This shouldn't be a stand-alone query. It should be adding some sinks to ExecTainted, the existing command injection query. That query isn't very easy to extend at the moment, so I have made a PR to fix that.

[owen-mc]

@p0wn4j My PR has been merged now, so you can extend the ExecTainted query easily.

[owen-mc]

That looks great. I've checked and the new version gets the same hits on LGTM as the old one. The other, more minor, comments from my previous review still stand.

Changes made

[owen-mc]

@p0wn4j Do you intend to make a bug bountry submission for this contribution?

[p0wn4j]

Yes I want to make a bug bounty submission.

[owen-mc]

@p0wn4j Great, that addresses all of the review comments. When you make a bug bountry submission this will be ready to pass to the next stage.

[p0wn4j]

OK, thanks for the review :)

[p0wn4j]

That looks great. I've checked and the new version gets the same hits on LGTM as the old one. The other, more minor, comments from my previous review still stand.

I have copied ExecTainted.ql, ExecCommon.qll from java/ql/src/Security/CWE/CWE-078/ path.