Java: Add taint step for String::concat.

aschackmull · aschackmull · commit 046d4a01dec4 · 2019-07-25T11:38:34.000+02:00
diff --git a/java/ql/src/semmle/code/java/dataflow/TaintTracking.qll b/java/ql/src/semmle/code/java/dataflow/TaintTracking.qll
@@ -377,6 +377,7 @@ module TaintTracking {
   private predicate taintPreservingQualifierToMethod(Method m) {
     m.getDeclaringType() instanceof TypeString and
     (
+      m.getName() = "concat" or
       m.getName() = "endsWith" or
       m.getName() = "getBytes" or
       m.getName() = "split" or
@@ -481,6 +482,10 @@ module TaintTracking {
       method.getName().matches("to%String") and arg = 0
     )
     or
+    method.getDeclaringType() instanceof TypeString and
+    method.getName() = "concat" and
+    arg = 0
+    or
     (
       method.getDeclaringType().hasQualifiedName("java.lang", "StringBuilder") or
       method.getDeclaringType().hasQualifiedName("java.lang", "StringBuffer")

Original file line number	Diff line number	Diff line change
`@@ -377,6 +377,7 @@ module TaintTracking {`
`377`	`377`	`private predicate taintPreservingQualifierToMethod(Method m) {`
`378`	`378`	`m.getDeclaringType() instanceof TypeString and`
`379`	`379`	`(`
	`380`	`+ m.getName() = "concat" or`
`380`	`381`	`m.getName() = "endsWith" or`
`381`	`382`	`m.getName() = "getBytes" or`
`382`	`383`	`m.getName() = "split" or`
`@@ -481,6 +482,10 @@ module TaintTracking {`
`481`	`482`	`method.getName().matches("to%String") and arg = 0`
`482`	`483`	`)`
`483`	`484`	`or`
	`485`	`+ method.getDeclaringType() instanceof TypeString and`
	`486`	`+ method.getName() = "concat" and`
	`487`	`+ arg = 0`
	`488`	`+ or`
`484`	`489`	`(`
`485`	`490`	`method.getDeclaringType().hasQualifiedName("java.lang", "StringBuilder") or`
`486`	`491`	`method.getDeclaringType().hasQualifiedName("java.lang", "StringBuffer")`