Add more regex use functions in String

joefarebrother · joefarebrother · commit 3ce0c2c23b66 · 2022-05-04T15:41:36.000+01:00
diff --git a/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll b/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll
@@ -86,7 +86,7 @@ private class JdkRegexMatchMethodAccess extends RegexMatchMethodAccess {
     or
     package = "java.lang" and
     type = "String" and
-    name = ["matches", "split"] and
+    name = ["matches", "split", "replaceAll", "replaceFirst"] and
     regexArg = 0 and
     stringArg = -1
     or
diff --git a/java/ql/lib/semmle/code/java/regex/RegexFlowModels.qll b/java/ql/lib/semmle/code/java/regex/RegexFlowModels.qll
@@ -14,6 +14,8 @@ private class RegexSinkCsv extends SinkModelCsv {
         "java.util;String;false;matches;(String);;Argument[0];regex-compile",
         "java.util;String;false;split;(String);;Argument[0];regex-compile",
         "java.util;String;false;split;(String,int);;Argument[0];regex-compile",
+        "java.util;String;false;replaceAll;(String,String);;Argument[0];regex-compile",
+        "java.util;String;false;replaceFirst;(String,String);;Argument[0];regex-compile",
         "com.google.common.base;Splitter;false;onPattern;(String);;Argument[0];regex-compile"
       ]
   }
diff --git a/java/ql/test/query-tests/security/CWE-730/PolyRedosTest.java b/java/ql/test/query-tests/security/CWE-730/PolyRedosTest.java
@@ -12,6 +12,8 @@ void test(HttpServletRequest request) {
         tainted.matches(reg); // $ hasPolyRedos
         tainted.split(reg); // $ hasPolyRedos
         tainted.split(reg, 7); // $ hasPolyRedos
+        tainted.replaceAll(reg, "a"); // $ hasPolyRedos
+        tainted.replaceFirst(reg, "a"); // $ hasPolyRedos
         Pattern.matches(reg, tainted); // $ hasPolyRedos
         Pattern.compile(reg).matcher(tainted).matches(); // $ hasPolyRedos
         Pattern.compile(reg).split(tainted); // $ hasPolyRedos

Original file line number	Diff line number	Diff line change
`@@ -14,6 +14,8 @@ private class RegexSinkCsv extends SinkModelCsv {`
`14`	`14`	`"java.util;String;false;matches;(String);;Argument[0];regex-compile",`
`15`	`15`	`"java.util;String;false;split;(String);;Argument[0];regex-compile",`
`16`	`16`	`"java.util;String;false;split;(String,int);;Argument[0];regex-compile",`
	`17`	`+ "java.util;String;false;replaceAll;(String,String);;Argument[0];regex-compile",`
	`18`	`+ "java.util;String;false;replaceFirst;(String,String);;Argument[0];regex-compile",`
`17`	`19`	`"com.google.common.base;Splitter;false;onPattern;(String);;Argument[0];regex-compile"`
`18`	`20`	`]`
`19`	`21`	`}`