Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5143585

Browse files
joefarebrotherjoefarebrother
committed
Fix to PolynomialRedos not finding results and to test cases not finding that
1 parent 91887ab commit 5143585

4 files changed

Lines changed: 44 additions & 27 deletions

File tree

‎java/ql/lib/semmle/code/java/regex/RegexTreeView.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@ class RegExpLiteral extends TRegExpLiteral, RegExpParent {
7373

7474
RegExpLiteral() { this = TRegExpLiteral(re) }
7575

76+
override string toString() { result = re.toString() }
77+
7678
override RegExpTerm getChild(int i) { i = 0 and result.getRegex() = re and result.isRootTerm() }
7779

7880
/** Holds if dot, `.`, matches all characters, including newlines. */

‎java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ class PolynomialRedosSink extends DataFlow::Node {
2424

2525
PolynomialRedosSink() { regexMatchedAgainst(reg.getRegex(), this.asExpr()) }
2626

27-
RegExpTerm getRegExp() { result = reg }
27+
RegExpTerm getRegExp() { result.getParent() = reg }
2828
}
2929

3030
class PolynomialRedosConfig extends TaintTracking::Configuration {
31-
PolynomialRedosConfig() { this = "PolynomialRodisConfig" }
31+
PolynomialRedosConfig() { this = "PolynomialRedosConfig" }
3232

3333
override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
3434

‎java/ql/test/query-tests/security/CWE-730/PolyRedosTest.java‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,30 @@
66
class PolyRedosTest {
77
void test(HttpServletRequest request) {
88
String tainted = request.getParameter("inp");
9-
String reg = "a\\.\\d+E?\\d+b";
9+
String reg = "0\\.\\d+E?\\d+!";
1010
Predicate<String> dummyPred = (s -> s.length() % 7 == 0);
1111

12-
tainted.matches(reg); // $ hasTaintFlow
13-
tainted.split(reg); // $ hasTaintFlow
14-
tainted.split(reg, 7); // $ hasTaintFlow
15-
Pattern.matches(reg, tainted); // $ hasTaintFlow
16-
Pattern.compile(reg).matcher(tainted).matches(); // $ hasTaintFlow
17-
Pattern.compile(reg).split(tainted); // $ hasTaintFlow
18-
Pattern.compile(reg, Pattern.DOTALL).split(tainted); // $ hasTaintFlow
19-
Pattern.compile(reg).split(tainted, 7); // $ hasTaintFlow
20-
Pattern.compile(reg).splitAsStream(tainted); // $ hasTaintFlow
21-
Pattern.compile(reg).asPredicate().test(tainted); // $ hasTaintFlow
22-
Pattern.compile(reg).asMatchPredicate().negate().and(dummyPred).or(dummyPred).test(tainted); // $ hasTaintFlow
23-
Predicate.not(dummyPred.and(dummyPred.or(Pattern.compile(reg).asPredicate()))).test(tainted); // $ hasTaintFlow
12+
tainted.matches(reg); // $ hasPolyRedos
13+
tainted.split(reg); // $ hasPolyRedos
14+
tainted.split(reg, 7); // $ hasPolyRedos
15+
Pattern.matches(reg, tainted); // $ hasPolyRedos
16+
Pattern.compile(reg).matcher(tainted).matches(); // $ hasPolyRedos
17+
Pattern.compile(reg).split(tainted); // $ hasPolyRedos
18+
Pattern.compile(reg, Pattern.DOTALL).split(tainted); // $ hasPolyRedos
19+
Pattern.compile(reg).split(tainted, 7); // $ hasPolyRedos
20+
Pattern.compile(reg).splitAsStream(tainted); // $ hasPolyRedos
21+
Pattern.compile(reg).asPredicate().test(tainted); // $ hasPolyRedos
22+
Pattern.compile(reg).asMatchPredicate().negate().and(dummyPred).or(dummyPred).test(tainted); // $ hasPolyRedos
23+
Predicate.not(dummyPred.and(dummyPred.or(Pattern.compile(reg).asPredicate()))).test(tainted); // $ hasPolyRedos
2424

25-
Splitter.on(Pattern.compile(reg)).split(tainted); // $ hasTaintFlow
25+
Splitter.on(Pattern.compile(reg)).split(tainted); // $ hasPolyRedos
2626
Splitter.on(reg).split(tainted);
27-
Splitter.onPattern(reg).split(tainted); // $ hasTaintFlow
28-
Splitter.onPattern(reg).splitToList(tainted); // $ hasTaintFlow
29-
Splitter.onPattern(reg).limit(7).omitEmptyStrings().trimResults().split(tainted); // $ hasTaintFlow
30-
Splitter.onPattern(reg).withKeyValueSeparator(" => ").split(tainted); // $ hasTaintFlow
27+
Splitter.onPattern(reg).split(tainted); // $ hasPolyRedos
28+
Splitter.onPattern(reg).splitToList(tainted); // $ hasPolyRedos
29+
Splitter.onPattern(reg).limit(7).omitEmptyStrings().trimResults().split(tainted); // $ hasPolyRedos
30+
Splitter.onPattern(reg).withKeyValueSeparator(" => ").split(tainted); // $ hasPolyRedos
3131
Splitter.on(";").withKeyValueSeparator(reg).split(tainted);
32-
Splitter.on(";").withKeyValueSeparator(Splitter.onPattern(reg)).split(tainted); // $ hasTaintFlow
32+
Splitter.on(";").withKeyValueSeparator(Splitter.onPattern(reg)).split(tainted); // $ hasPolyRedos
3333

3434
}
3535
}

‎java/ql/test/query-tests/security/CWE-730/PolynomialReDoS.ql‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import java
22
import TestUtilities.InlineExpectationsTest
3-
import TestUtilities.InlineFlowTest
43
import semmle.code.java.security.performance.SuperlinearBackTracking
54
import semmle.code.java.dataflow.DataFlow
65
import semmle.code.java.regex.RegexTreeView
@@ -11,19 +10,35 @@ class PolynomialRedosSink extends DataFlow::Node {
1110
RegExpLiteral reg;
1211

1312
PolynomialRedosSink() { regexMatchedAgainst(reg.getRegex(), this.asExpr()) }
14-
// RegExpTerm getRegExp() { result = reg }
13+
14+
RegExpTerm getRegExp() { result.getParent() = reg }
1515
}
1616

1717
class PolynomialRedosConfig extends TaintTracking::Configuration {
18-
PolynomialRedosConfig() { this = "PolynomialRodisConfig" }
18+
PolynomialRedosConfig() { this = "PolynomialRedosConfig" }
1919

2020
override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
2121

2222
override predicate isSink(DataFlow::Node sink) { sink instanceof PolynomialRedosSink }
2323
}
2424

25-
class HasFlowTest extends InlineFlowTest {
26-
override DataFlow::Configuration getTaintFlowConfig() { result = any(PolynomialRedosConfig c) }
25+
class HasPolyRedos extends InlineExpectationsTest {
26+
HasPolyRedos() { this = "HasPolyRedos" }
27+
28+
override string getARelevantTag() { result = ["hasPolyRedos"] }
2729

28-
override DataFlow::Configuration getValueFlowConfig() { none() }
30+
override predicate hasActualResult(Location location, string element, string tag, string value) {
31+
tag = "hasPolyRedos" and
32+
exists(
33+
PolynomialRedosConfig config, DataFlow::PathNode source, DataFlow::PathNode sink,
34+
PolynomialRedosSink sinkNode, PolynomialBackTrackingTerm regexp
35+
|
36+
config.hasFlowPath(source, sink) and
37+
sinkNode = sink.getNode() and
38+
regexp.getRootTerm() = sinkNode.getRegExp() and
39+
location = sinkNode.getLocation() and
40+
element = sinkNode.toString() and
41+
value = ""
42+
)
43+
}
2944
}

0 commit comments

Comments
 (0)