Model Appenable and Writer

Benjamin Muskalla · Benjamin Muskalla · commit 37ca6a5e4124 · 2022-01-14T11:12:35.000+01:00
This allows us to track taint carried through all kind of writers.
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -91,6 +91,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.guava.Guava
   private import semmle.code.java.frameworks.jackson.JacksonSerializability
   private import semmle.code.java.frameworks.javaee.jsf.JSFRenderer
+  private import semmle.code.java.frameworks.JavaIo
   private import semmle.code.java.frameworks.JavaxJson
   private import semmle.code.java.frameworks.JaxWS
   private import semmle.code.java.frameworks.JoddJson
diff --git a/java/ql/lib/semmle/code/java/frameworks/JavaIo.qll b/java/ql/lib/semmle/code/java/frameworks/JavaIo.qll
@@ -0,0 +1,16 @@
+/** Definitions of taint steps in Objects class of the JDK */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class ObjectsSummaryCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //`namespace; type; subtypes; name; signature; ext; input; output; kind`
+        "java.lang;Appendable;false;append;;;Argument[0];Argument[-1];value",
+        "java.lang;Appendable;false;append;;;Argument[-1];ReturnValue;value",
+        "java.io;Writer;false;write;;;Argument[0];Argument[-1];value"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/Strings.qll b/java/ql/lib/semmle/code/java/frameworks/Strings.qll
@@ -40,9 +40,6 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.lang;String;false;valueOf;(char);;Argument[0];ReturnValue;taint",
         "java.lang;String;false;valueOf;(char[],int,int);;Argument[0];ReturnValue;taint",
         "java.lang;String;false;valueOf;(char[]);;Argument[0];ReturnValue;taint",
-        "java.io;StringWriter;true;append;;;Argument[0];Argument[-1];taint",
-        "java.io;StringWriter;true;append;;;Argument[-1];ReturnValue;value",
-        "java.io;StringWriter;true;write;;;Argument[0];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;AbstractStringBuilder;(String);;Argument[0];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;append;;;Argument[0];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;append;;;Argument[-1];ReturnValue;value",
