Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 120fb25

Browse files
michaelnebelmichaelnebel
committed
Java: Sync files and model generator and tests.
1 parent 5255e16 commit 120fb25

7 files changed

Lines changed: 177 additions & 78 deletions

File tree

‎java/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Capture negative summary models.
3+
* @description Finds negative summary models to be used by other queries.
4+
* @kind diagnostic
5+
* @id java/utils/model-generator/negative-summary-models
6+
* @tags model-generator
7+
*/
8+
9+
private import internal.CaptureModels
10+
private import internal.CaptureSummaryFlow
11+
12+
from TargetApi api, string noflow
13+
where noflow = captureNoFlow(api)
14+
select noflow order by noflow

‎java/ql/src/utils/model-generator/CaptureSummaryModels.ql‎

Lines changed: 1 addition & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -7,78 +7,7 @@
77
*/
88

99
private import internal.CaptureModels
10-
11-
/**
12-
* Capture fluent APIs that return `this`.
13-
* Example of a fluent API:
14-
* ```java
15-
* public class Foo {
16-
* public Foo someAPI() {
17-
* // some side-effect
18-
* return this;
19-
* }
20-
* }
21-
* ```
22-
*
23-
* Capture APIs that transfer taint from an input parameter to an output return
24-
* value or parameter.
25-
* Allows a sequence of read steps followed by a sequence of store steps.
26-
*
27-
* Examples:
28-
*
29-
* ```java
30-
* public class Foo {
31-
* private String tainted;
32-
*
33-
* public String returnsTainted() {
34-
* return tainted;
35-
* }
36-
*
37-
* public void putsTaintIntoParameter(List<String> foo) {
38-
* foo.add(tainted);
39-
* }
40-
* }
41-
* ```
42-
* Captured Models:
43-
* ```
44-
* p;Foo;true;returnsTainted;;Argument[-1];ReturnValue;taint
45-
* p;Foo;true;putsTaintIntoParameter;(List);Argument[-1];Argument[0];taint
46-
* ```
47-
*
48-
* ```java
49-
* public class Foo {
50-
* private String tainted;
51-
* public void doSomething(String input) {
52-
* tainted = input;
53-
* }
54-
* ```
55-
* Captured Model:
56-
* ```p;Foo;true;doSomething;(String);Argument[0];Argument[-1];taint```
57-
*
58-
* ```java
59-
* public class Foo {
60-
* public String returnData(String tainted) {
61-
* return tainted.substring(0,10)
62-
* }
63-
* }
64-
* ```
65-
* Captured Model:
66-
* ```p;Foo;true;returnData;;Argument[0];ReturnValue;taint```
67-
*
68-
* ```java
69-
* public class Foo {
70-
* public void addToList(String tainted, List<String> foo) {
71-
* foo.add(tainted);
72-
* }
73-
* }
74-
* ```
75-
* Captured Model:
76-
* ```p;Foo;true;addToList;;Argument[0];Argument[1];taint```
77-
*/
78-
string captureFlow(TargetApi api) {
79-
result = captureQualifierFlow(api) or
80-
result = captureThroughFlow(api)
81-
}
10+
private import internal.CaptureSummaryFlow
8211

8312
from TargetApi api, string flow
8413
where flow = captureFlow(api)

‎java/ql/src/utils/model-generator/internal/CaptureModels.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ private string asSummaryModel(TargetApi api, string input, string output, string
4848
+ "generated"
4949
}
5050

51+
string asNegativeSummaryModel(TargetApi api) { result = asPartialNegativeModel(api) + "generated" }
52+
53+
predicate partialNegativeModel = asPartialNegativeModel/1;
54+
5155
/**
5256
* Gets the value summary model for `api` with `input` and `output`.
5357
*/

‎java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,38 @@ private string typeAsSummaryModel(TargetApiSpecific api) {
9898
result = typeAsModel(bestTypeForModel(api))
9999
}
100100

101+
private predicate partialModel(TargetApiSpecific api, string type, string name, string parameters) {
102+
type = typeAsSummaryModel(api) and
103+
name = api.getName() and
104+
parameters = ExternalFlow::paramsString(api)
105+
}
106+
101107
/**
102108
* Computes the first 6 columns for CSV rows.
103109
*/
104110
string asPartialModel(TargetApiSpecific api) {
105-
result =
106-
typeAsSummaryModel(api) + ";" //
107-
+ isExtensible(bestTypeForModel(api)) + ";" //
108-
+ api.getName() + ";" //
109-
+ ExternalFlow::paramsString(api) + ";" //
110-
+ /* ext + */ ";" //
111+
exists(string type, string name, string parameters |
112+
partialModel(api, type, name, parameters) and
113+
result =
114+
type + ";" //
115+
+ isExtensible(bestTypeForModel(api)) + ";" //
116+
+ name + ";" //
117+
+ parameters + ";" //
118+
+ /* ext + */ ";" //
119+
)
120+
}
121+
122+
/**
123+
* Computes the first 4 columns for negative CSV rows.
124+
*/
125+
string asPartialNegativeModel(TargetApiSpecific api) {
126+
exists(string type, string name, string parameters |
127+
partialModel(api, type, name, parameters) and
128+
result =
129+
type + ";" //
130+
+ name + ";" //
131+
+ parameters + ";" //
132+
)
111133
}
112134

113135
private predicate isPrimitiveTypeUsedForBulkData(J::Type t) {

‎java/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
private import CaptureModels
2+
3+
/**
4+
* Capture fluent APIs that return `this`.
5+
* Example of a fluent API:
6+
* ```java
7+
* public class Foo {
8+
* public Foo someAPI() {
9+
* // some side-effect
10+
* return this;
11+
* }
12+
* }
13+
* ```
14+
*
15+
* Capture APIs that transfer taint from an input parameter to an output return
16+
* value or parameter.
17+
* Allows a sequence of read steps followed by a sequence of store steps.
18+
*
19+
* Examples:
20+
*
21+
* ```java
22+
* public class Foo {
23+
* private String tainted;
24+
*
25+
* public String returnsTainted() {
26+
* return tainted;
27+
* }
28+
*
29+
* public void putsTaintIntoParameter(List<String> foo) {
30+
* foo.add(tainted);
31+
* }
32+
* }
33+
* ```
34+
* Captured Models:
35+
* ```
36+
* p;Foo;true;returnsTainted;;Argument[-1];ReturnValue;taint
37+
* p;Foo;true;putsTaintIntoParameter;(List);Argument[-1];Argument[0];taint
38+
* ```
39+
*
40+
* ```java
41+
* public class Foo {
42+
* private String tainted;
43+
* public void doSomething(String input) {
44+
* tainted = input;
45+
* }
46+
* ```
47+
* Captured Model:
48+
* ```p;Foo;true;doSomething;(String);Argument[0];Argument[-1];taint```
49+
*
50+
* ```java
51+
* public class Foo {
52+
* public String returnData(String tainted) {
53+
* return tainted.substring(0,10)
54+
* }
55+
* }
56+
* ```
57+
* Captured Model:
58+
* ```p;Foo;true;returnData;;Argument[0];ReturnValue;taint```
59+
*
60+
* ```java
61+
* public class Foo {
62+
* public void addToList(String tainted, List<String> foo) {
63+
* foo.add(tainted);
64+
* }
65+
* }
66+
* ```
67+
* Captured Model:
68+
* ```p;Foo;true;addToList;;Argument[0];Argument[1];taint```
69+
*/
70+
string captureFlow(TargetApi api) {
71+
result = captureQualifierFlow(api) or
72+
result = captureThroughFlow(api)
73+
}
74+
75+
/**
76+
* Gets the negative summary for `api`, if any.
77+
* A negative summary is generated, if there does not exist any positive flow that
78+
* shares the same summary prefix - otherwise these models will be indistinguishable.
79+
*/
80+
string captureNoFlow(TargetApi api) {
81+
not exists(TargetApi other, string flow |
82+
flow = captureFlow(other) and
83+
partialNegativeModel(other) = partialNegativeModel(api)
84+
) and
85+
result = asNegativeSummaryModel(api)
86+
}

‎java/ql/test/utils/model-generator/CaptureNegativeSummaryModels.expected‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
| p;AbstractImplOfExternalSPI;AbstractImplOfExternalSPI;();generated |
2+
| p;Factory;getIntValue;();generated |
3+
| p;FinalClass;FinalClass;();generated |
4+
| p;FinalClass;returnsConstant;();generated |
5+
| p;FluentAPI$Inner;Inner;();generated |
6+
| p;FluentAPI$Inner;notThis;(String);generated |
7+
| p;FluentAPI;FluentAPI;();generated |
8+
| p;ImmutablePojo;getX;();generated |
9+
| p;ImplOfExternalSPI;ImplOfExternalSPI;();generated |
10+
| p;InnerClasses$CaptureMe;CaptureMe;();generated |
11+
| p;InnerClasses;InnerClasses;();generated |
12+
| p;InnerHolder;InnerHolder;();generated |
13+
| p;Joiner;length;();generated |
14+
| p;MultipleImpls$Strat1;Strat1;();generated |
15+
| p;MultipleImpls$Strat2;Strat2;();generated |
16+
| p;MultipleImpls$Strat3;Strat3;();generated |
17+
| p;MultipleImpls;MultipleImpls;();generated |
18+
| p;ParamFlow;ParamFlow;();generated |
19+
| p;ParamFlow;ignorePrimitiveReturnValue;(String);generated |
20+
| p;ParamFlow;mapType;(Class);generated |
21+
| p;Pojo;Pojo;();generated |
22+
| p;Pojo;doNotSetValue;(String);generated |
23+
| p;Pojo;getBigDecimal;();generated |
24+
| p;Pojo;getBigInt;();generated |
25+
| p;Pojo;getBoxedArray;();generated |
26+
| p;Pojo;getBoxedCollection;();generated |
27+
| p;Pojo;getBoxedValue;();generated |
28+
| p;Pojo;getFloatArray;();generated |
29+
| p;Pojo;getIntValue;();generated |
30+
| p;Pojo;getPrimitiveArray;();generated |
31+
| p;PrivateFlowViaPublicInterface$SPI;openStream;();generated |
32+
| p;PrivateFlowViaPublicInterface$SPI;openStreamNone;();generated |
33+
| p;PrivateFlowViaPublicInterface;PrivateFlowViaPublicInterface;();generated |
34+
| p;PrivateFlowViaPublicInterface;createAnSPIWithoutTrackingFile;(File);generated |
35+
| p;Sinks;Sinks;();generated |
36+
| p;Sinks;copyFileToDirectory;(Path,Path,CopyOption[]);generated |
37+
| p;Sinks;propagate;(String);generated |
38+
| p;Sinks;readUrl;(URL,Charset);generated |
39+
| p;Sources;Sources;();generated |
40+
| p;Sources;readUrl;(URL);generated |
41+
| p;Sources;socketStream;();generated |
42+
| p;Sources;sourceToParameter;(InputStream[],List);generated |
43+
| p;Sources;wrappedSocketStream;();generated |

‎java/ql/test/utils/model-generator/CaptureNegativeSummaryModels.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
utils/model-generator/CaptureNegativeSummaryModels.ql

0 commit comments

Comments
 (0)