Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 02b0b40

Browse files
am0o0am0o0
committed
remove useless predicate
add missed FlowState
1 parent 484923e commit 02b0b40

3 files changed

Lines changed: 13 additions & 105 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-522-DecompressionBombs/DecompressionBomb.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ module DecompressionBombsConfig implements DataFlow::StateConfigSig {
3737
state instanceof ApacheCommons
3838
or
3939
state instanceof XerialSnappy
40+
or
41+
state instanceof UtilZip
4042
)
4143
}
4244

‎java/ql/src/experimental/semmle/code/java/security/DecompressionBomb.qll‎

Lines changed: 7 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -81,16 +81,11 @@ module XerialSnappy {
8181
this.getReceiverType() instanceof TypeInputStream and
8282
this.getCallee().hasName(["read", "readNBytes", "readAllBytes"])
8383
}
84-
85-
/**
86-
* A method Access as a sink which responsible for reading bytes
87-
*/
88-
MethodCall getAByteRead() { result = this }
8984
}
9085

9186
class Sink extends DecompressionBomb::Sink {
9287
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
93-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
88+
sink.asExpr() = any(ReadInputStreamCall r) and
9489
state instanceof DecompressionBomb::XerialSnappy
9590
}
9691
}
@@ -203,16 +198,11 @@ module ApacheCommons {
203198
this.getReceiverType() instanceof TypeCompressors and
204199
this.getCallee().hasName(["read", "readNBytes", "readAllBytes"])
205200
}
206-
207-
/**
208-
* A method Access as a sink which responsible for reading bytes
209-
*/
210-
MethodCall getAByteRead() { result = this }
211201
}
212202

213203
class Sink extends DecompressionBomb::Sink {
214204
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
215-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
205+
sink.asExpr() = any(ReadInputStreamCall r) and
216206
state instanceof DecompressionBomb::ApacheCommons
217207
}
218208
}
@@ -278,16 +268,11 @@ module ApacheCommons {
278268
this.getReceiverType() instanceof TypeArchivers and
279269
this.getCallee().hasName(["read", "readNBytes", "readAllBytes"])
280270
}
281-
282-
/**
283-
* A method Access as a sink which responsible for reading bytes
284-
*/
285-
MethodCall getAByteRead() { result = this }
286271
}
287272

288273
class Sink extends DecompressionBomb::Sink {
289274
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
290-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
275+
sink.asExpr() = any(ReadInputStreamCall r) and
291276
state instanceof DecompressionBomb::ApacheCommons
292277
}
293278
}
@@ -367,16 +352,11 @@ module ApacheCommons {
367352
) and
368353
this.getCallee().hasName(["read", "readNBytes", "readAllBytes"])
369354
}
370-
371-
/**
372-
* A method Access as a sink which responsible for reading bytes
373-
*/
374-
MethodCall getAByteRead() { result = this }
375355
}
376356

377357
class Sink extends DecompressionBomb::Sink {
378358
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
379-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
359+
sink.asExpr() = any(ReadInputStreamCall r) and
380360
state instanceof DecompressionBomb::ApacheCommons
381361
}
382362
}
@@ -404,16 +384,11 @@ module Zip4j {
404384
this.getReceiverType() instanceof TypeZipInputStream and
405385
this.getMethod().hasName(["read", "readNBytes", "readAllBytes"])
406386
}
407-
408-
/**
409-
* A method Access as a sink which responsible for reading bytes
410-
*/
411-
MethodCall getAByteRead() { result = this }
412387
}
413388

414389
class Sink extends DecompressionBomb::Sink {
415390
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
416-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
391+
sink.asExpr() = any(ReadInputStreamCall r) and
417392
state instanceof DecompressionBomb::Zip4j
418393
}
419394
}
@@ -446,40 +421,6 @@ module Zip4j {
446421
}
447422
}
448423

449-
/**
450-
* Providing sinks that can be related to reading uncontrolled buffer and bytes for `org.apache.commons.io` package
451-
*/
452-
module CommonsIO {
453-
/**
454-
* The Access to Methods which work with byes and inputStreams and buffers
455-
*/
456-
class IOUtils extends MethodCall {
457-
IOUtils() {
458-
this.getMethod()
459-
.hasName([
460-
"copy", "copyLarge", "read", "readFully", "readLines", "toBufferedInputStream",
461-
"toByteArray", "toCharArray", "toString", "buffer"
462-
]) and
463-
this.getMethod().getDeclaringType().hasQualifiedName("org.apache.commons.io", "IOUtils")
464-
}
465-
}
466-
467-
class Sink extends DecompressionBomb::Sink {
468-
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
469-
sink.asExpr() = any(IOUtils r).getArgument(0) and
470-
(
471-
state instanceof DecompressionBomb::Zip4j
472-
or
473-
state instanceof DecompressionBomb::Inflator
474-
or
475-
state instanceof DecompressionBomb::ApacheCommons
476-
or
477-
state instanceof DecompressionBomb::XerialSnappy
478-
)
479-
}
480-
}
481-
}
482-
483424
/**
484425
* Providing Decompression sinks and additional taint steps for `java.util.zip` package
485426
*/
@@ -503,16 +444,11 @@ module Zip {
503444
this.getReceiverType() instanceof TypeInputStream and
504445
this.getCallee().hasName(["read", "readNBytes", "readAllBytes"])
505446
}
506-
507-
/**
508-
* A method Access as a sink which responsible for reading bytes
509-
*/
510-
MethodCall getAByteRead() { result = this }
511447
}
512448

513449
class ReadInputStreamSink extends DecompressionBomb::Sink {
514450
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
515-
sink.asExpr() = any(ReadInputStreamCall r).getAByteRead() and
451+
sink.asExpr() = any(ReadInputStreamCall r) and
516452
state instanceof DecompressionBomb::UtilZip
517453
}
518454
}
@@ -602,16 +538,11 @@ module Zip {
602538
this.getReceiverType() instanceof TypeInflator and
603539
this.getCallee().hasName("inflate")
604540
}
605-
606-
/**
607-
* A method Access as a sink which responsible for reading bytes
608-
*/
609-
MethodCall getAByteRead() { result = this }
610541
}
611542

612543
class InflateSink extends DecompressionBomb::Sink {
613544
override predicate sink(DataFlow::Node sink, DecompressionBomb::DecompressionState state) {
614-
sink.asExpr() = any(InflateCall r).getAByteRead() and
545+
sink.asExpr() = any(InflateCall r) and
615546
state instanceof DecompressionBomb::Inflator
616547
}
617548
}

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/CommonsCompressHandler.java‎

Lines changed: 4 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
import org.apache.commons.compress.compressors.CompressorInputStream;
99
import org.apache.commons.compress.compressors.CompressorStreamFactory;
1010
import org.apache.commons.compress.compressors.gzip.*;
11-
import org.apache.commons.io.IOUtils;
1211

1312
public class CommonsCompressHandler {
1413
public static void commonsCompressorInputStream(InputStream inputStream) throws IOException {
@@ -37,38 +36,14 @@ public static void commonsCompressorInputStream(InputStream inputStream) throws
3736
}
3837
out.close();
3938
gzIn.close();
40-
41-
try (GzipCompressorInputStream gzIn2 =
42-
new org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream(in)) {
43-
File f = new File("tmpfile");
44-
try (OutputStream o = Files.newOutputStream(f.toPath())) {
45-
IOUtils.copy(gzIn2, o); // BAD
46-
}
47-
} catch (IOException e) {
48-
throw new RuntimeException(e);
49-
}
5039
}
5140

5241
static void commonsCompressArchiveInputStream(InputStream inputStream) throws ArchiveException {
5342
new org.apache.commons.compress.archivers.ar.ArArchiveInputStream(inputStream);
5443
new org.apache.commons.compress.archivers.arj.ArjArchiveInputStream(inputStream);
5544
new org.apache.commons.compress.archivers.cpio.CpioArchiveInputStream(inputStream);
5645
new org.apache.commons.compress.archivers.jar.JarArchiveInputStream(inputStream);
57-
try (org.apache.commons.compress.archivers.zip.ZipArchiveInputStream zipInputStream =
58-
new org.apache.commons.compress.archivers.zip.ZipArchiveInputStream(inputStream)) {
59-
ArchiveEntry entry = null;
60-
while ((entry = zipInputStream.getNextEntry()) != null) {
61-
if (!zipInputStream.canReadEntryData(entry)) {
62-
continue;
63-
}
64-
File f = new File("tmpfile");
65-
try (OutputStream o = Files.newOutputStream(f.toPath())) {
66-
IOUtils.copy(zipInputStream, o); // BAD
67-
}
68-
}
69-
} catch (IOException e) {
70-
throw new RuntimeException(e);
71-
}
46+
new org.apache.commons.compress.archivers.zip.ZipArchiveInputStream(inputStream);
7247
}
7348

7449
static void commonsCompressArchiveInputStream2(InputStream inputStream) {
@@ -83,7 +58,7 @@ static void commonsCompressArchiveInputStream2(InputStream inputStream) {
8358
File f = new File("tmpfile");
8459
try (OutputStream outputStream = new FileOutputStream(f)) {
8560
int readLen;
86-
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
61+
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
8762
outputStream.write(readBuffer, 0, readLen);
8863
}
8964
}
@@ -106,7 +81,7 @@ static void commonsCompressArchiveStreamFactory(InputStream inputStream)
10681
File f = new File("tmpfile");
10782
try (OutputStream outputStream = new FileOutputStream(f)) {
10883
int readLen;
109-
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
84+
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
11085
outputStream.write(readBuffer, 0, readLen);
11186
}
11287
}
@@ -121,7 +96,7 @@ static void commonsCompressCompressorStreamFactory(InputStream inputStream)
12196
int buffersize = 4096;
12297
final byte[] buffer = new byte[buffersize];
12398
int n = 0;
124-
while (-1 != (n = in.read(buffer))) { // BAD
99+
while (-1 != (n = in.read(buffer))) { // BAD
125100
out.write(buffer, 0, n);
126101
}
127102
out.close();

0 commit comments

Comments
 (0)