Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5bba7f6

Browse files
joefarebrotherjoefarebrother
committed
Add unit tests
1 parent da6e949 commit 5bba7f6

14 files changed

Lines changed: 576 additions & 28 deletions

File tree

‎java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ private class UtilMethod extends TaintPreservingCallable {
137137
this.hasName(mtd)
138138
|
139139
ty = "EntityUtils" and
140-
mtd = ["toString", "toByteArray"]
140+
mtd = ["toString", "toByteArray", "getContentCharSet", "getContentMimeType"]
141141
or
142142
ty = "EncodingUtils" and
143143
mtd = ["getAsciiBytes", "getAsciiString", "getBytes", "getString"]

‎java/ql/test/library-tests/frameworks/apache-http/A.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import org.apache.http.*;
2+
import org.apache.http.protocol.*;
3+
import org.apache.http.util.*;
4+
import org.apache.http.entity.*;
5+
6+
class A {
7+
static Object taint() { return null; }
8+
9+
static void sink(Object o) { }
10+
11+
class Test1 implements HttpRequestHandler {
12+
public void handle(HttpRequest req, HttpResponse res, HttpContext ctx) {
13+
A.sink(req.getRequestLine());
14+
A.sink(req.getRequestLine().getUri());
15+
A.sink(req.getRequestLine().getMethod());
16+
A.sink(req.getAllHeaders());
17+
HeaderIterator it = req.headerIterator();
18+
A.sink(it.next());
19+
A.sink(it.nextHeader());
20+
Header h = req.getHeaders("abc")[3];
21+
A.sink(h.getName());
22+
A.sink(h.getValue());
23+
HeaderElement el = h.getElements()[0];
24+
A.sink(el.getName());
25+
A.sink(el.getValue());
26+
A.sink(el.getParameters());
27+
A.sink(el.getParameterByName("abc").getValue());
28+
A.sink(el.getParameter(0).getName());
29+
HttpEntity ent = ((HttpEntityEnclosingRequest)req).getEntity();
30+
A.sink(ent.getContent());
31+
A.sink(ent.getContentEncoding());
32+
A.sink(ent.getContentType());
33+
A.sink(EntityUtils.toString(ent));
34+
A.sink(EntityUtils.toByteArray(ent));
35+
A.sink(EntityUtils.getContentCharSet(ent));
36+
A.sink(EntityUtils.getContentMimeType(ent));
37+
res.setEntity(new StringEntity("<a href='" + req.getRequestLine().getUri() + "'>a</a>"));
38+
EntityUtils.updateEntity(res, new ByteArrayEntity(EntityUtils.toByteArray(ent)));
39+
}
40+
}
41+
}

‎java/ql/test/library-tests/frameworks/apache-http/flow.expected‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
| A.java:12:28:12:42 | req | A.java:13:20:13:39 | getRequestLine(...) |
2+
| A.java:12:28:12:42 | req | A.java:14:20:14:48 | getUri(...) |
3+
| A.java:12:28:12:42 | req | A.java:15:20:15:51 | getMethod(...) |
4+
| A.java:12:28:12:42 | req | A.java:16:20:16:38 | getAllHeaders(...) |
5+
| A.java:12:28:12:42 | req | A.java:18:20:18:28 | next(...) |
6+
| A.java:12:28:12:42 | req | A.java:19:20:19:34 | nextHeader(...) |
7+
| A.java:12:28:12:42 | req | A.java:21:20:21:30 | getName(...) |
8+
| A.java:12:28:12:42 | req | A.java:22:20:22:31 | getValue(...) |
9+
| A.java:12:28:12:42 | req | A.java:24:20:24:31 | getName(...) |
10+
| A.java:12:28:12:42 | req | A.java:25:20:25:32 | getValue(...) |
11+
| A.java:12:28:12:42 | req | A.java:26:20:26:37 | getParameters(...) |
12+
| A.java:12:28:12:42 | req | A.java:27:20:27:58 | getValue(...) |
13+
| A.java:12:28:12:42 | req | A.java:28:20:28:47 | getName(...) |
14+
| A.java:12:28:12:42 | req | A.java:30:20:30:35 | getContent(...) |
15+
| A.java:12:28:12:42 | req | A.java:31:20:31:43 | getContentEncoding(...) |
16+
| A.java:12:28:12:42 | req | A.java:32:20:32:39 | getContentType(...) |
17+
| A.java:12:28:12:42 | req | A.java:33:20:33:44 | toString(...) |
18+
| A.java:12:28:12:42 | req | A.java:34:20:34:47 | toByteArray(...) |
19+
| A.java:12:28:12:42 | req | A.java:35:20:35:53 | getContentCharSet(...) |
20+
| A.java:12:28:12:42 | req | A.java:36:20:36:54 | getContentMimeType(...) |
21+
| A.java:12:28:12:42 | req | A.java:37:27:37:99 | new StringEntity(...) |
22+
| A.java:12:28:12:42 | req | A.java:38:43:38:91 | new ByteArrayEntity(...) |
23+
| A.java:30:20:30:35 | getContent(...) | A.java:30:20:30:35 | getContent(...) |

‎java/ql/test/library-tests/frameworks/apache-http/flow.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
import java
2+
import semmle.code.java.dataflow.TaintTracking
3+
import semmle.code.java.dataflow.FlowSources
4+
import semmle.code.java.security.XSS
5+
6+
class Conf extends TaintTracking::Configuration {
7+
Conf() { this = "qltest:frameworks:apache-http" }
8+
9+
override predicate isSource(DataFlow::Node n) {
10+
n.asExpr().(MethodAccess).getMethod().hasName("taint")
11+
or
12+
n instanceof RemoteFlowSource
13+
}
14+
15+
override predicate isSink(DataFlow::Node n) {
16+
exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
17+
or
18+
n instanceof XssSink
19+
}
20+
}
21+
22+
from DataFlow::Node src, DataFlow::Node sink, Conf conf
23+
where conf.hasFlow(src, sink)
24+
select src, sink

‎java/ql/test/library-tests/frameworks/apache-http/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-http-4.4.13

‎java/ql/test/stubs/apache-http-4.4.13/org/apache/http/Header.java‎

Lines changed: 10 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
11
/*
2-
* $HeadURL: http://svn.apache.org/repos/asf/httpcomponents/httpcore/trunk/module-main/src/main/java/org/apache/http/Header.java $
3-
* $Revision: 569636 $
4-
* $Date: 2007-08-25 00:34:47 -0700 (Sat, 25 Aug 2007) $
5-
*
62
* ====================================================================
73
* Licensed to the Apache Software Foundation (ASF) under one
84
* or more contributor license agreements. See the NOTICE file
@@ -33,38 +29,25 @@
3329

3430
/**
3531
* Represents an HTTP header field.
36-
*
37-
* <p>
38-
* The HTTP header fields follow the same generic format as that given in
39-
* Section 3.1 of RFC 822. Each header field consists of a name followed by a
40-
* colon (":") and the field value. Field names are case-insensitive. The field
41-
* value MAY be preceded by any amount of LWS, though a single SP is preferred.
4232
*
43-
* <pre>
33+
* <p>The HTTP header fields follow the same generic format as
34+
* that given in Section 3.1 of RFC 822. Each header field consists
35+
* of a name followed by a colon (":") and the field value. Field names
36+
* are case-insensitive. The field value MAY be preceded by any amount
37+
* of LWS, though a single SP is preferred.
38+
*
39+
*<pre>
4440
* message-header = field-name ":" [ field-value ]
4541
* field-name = token
4642
* field-value = *( field-content | LWS )
4743
* field-content = &lt;the OCTETs making up the field-value
4844
* and consisting of either *TEXT or combinations
4945
* of token, separators, and quoted-string&gt;
50-
* </pre>
51-
*
52-
* @author <a href="mailto:[email protected]">Remy Maucherat</a>
53-
* @author <a href="mailto:oleg at ural.ru">Oleg Kalnichevski</a>
54-
* @version $Revision: 569636 $
46+
*</pre>
5547
*
56-
* @deprecated Please use {@link java.net.URL#openConnection} instead. Please
57-
* visit <a href=
58-
* "http://android-developers.blogspot.com/2011/09/androids-http-clients.html">this
59-
* webpage</a> for further details.
48+
* @since 4.0
6049
*/
61-
@Deprecated
62-
public interface Header {
63-
64-
String getName();
65-
66-
String getValue();
67-
50+
public interface Header extends NameValuePair {
6851
HeaderElement[] getElements() throws ParseException;
6952

7053
}

‎java/ql/test/stubs/apache-http-4.4.13/org/apache/http/HttpResponse.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/*
2+
* ====================================================================
3+
* Licensed to the Apache Software Foundation (ASF) under one
4+
* or more contributor license agreements. See the NOTICE file
5+
* distributed with this work for additional information
6+
* regarding copyright ownership. The ASF licenses this file
7+
* to you under the Apache License, Version 2.0 (the
8+
* "License"); you may not use this file except in compliance
9+
* with the License. You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing,
14+
* software distributed under the License is distributed on an
15+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
* KIND, either express or implied. See the License for the
17+
* specific language governing permissions and limitations
18+
* under the License.
19+
* ====================================================================
20+
*
21+
* This software consists of voluntary contributions made by many
22+
* individuals on behalf of the Apache Software Foundation. For more
23+
* information on the Apache Software Foundation, please see
24+
* <http://www.apache.org/>.
25+
*
26+
*/
27+
28+
package org.apache.http;
29+
30+
import java.util.Locale;
31+
32+
public interface HttpResponse extends HttpMessage {
33+
// StatusLine getStatusLine();
34+
35+
// void setStatusLine(StatusLine statusline);
36+
37+
// void setStatusLine(ProtocolVersion ver, int code);
38+
39+
// void setStatusLine(ProtocolVersion ver, int code, String reason);
40+
41+
void setStatusCode(int code)
42+
throws IllegalStateException;
43+
44+
void setReasonPhrase(String reason)
45+
throws IllegalStateException;
46+
47+
HttpEntity getEntity();
48+
49+
void setEntity(HttpEntity entity);
50+
51+
Locale getLocale();
52+
53+
void setLocale(Locale loc);
54+
55+
}

‎java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/AbstractHttpEntity.java‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
* ====================================================================
3+
* Licensed to the Apache Software Foundation (ASF) under one
4+
* or more contributor license agreements. See the NOTICE file
5+
* distributed with this work for additional information
6+
* regarding copyright ownership. The ASF licenses this file
7+
* to you under the Apache License, Version 2.0 (the
8+
* "License"); you may not use this file except in compliance
9+
* with the License. You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing,
14+
* software distributed under the License is distributed on an
15+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
* KIND, either express or implied. See the License for the
17+
* specific language governing permissions and limitations
18+
* under the License.
19+
* ====================================================================
20+
*
21+
* This software consists of voluntary contributions made by many
22+
* individuals on behalf of the Apache Software Foundation. For more
23+
* information on the Apache Software Foundation, please see
24+
* <http://www.apache.org/>.
25+
*
26+
*/
27+
28+
package org.apache.http.entity;
29+
30+
import java.io.IOException;
31+
import org.apache.http.HttpEntity;
32+
import org.apache.http.Header;
33+
34+
public abstract class AbstractHttpEntity implements HttpEntity {
35+
@Override
36+
public Header getContentType() {
37+
return null;
38+
}
39+
40+
@Override
41+
public Header getContentEncoding() {
42+
return null;
43+
}
44+
45+
@Override
46+
public boolean isChunked() {
47+
return false;
48+
}
49+
50+
public void setContentType(final Header contentType) {
51+
}
52+
53+
public void setContentType(final String ctString) {
54+
}
55+
56+
public void setContentEncoding(final Header contentEncoding) {
57+
}
58+
59+
public void setContentEncoding(final String ceString) {
60+
}
61+
62+
public void setChunked(final boolean b) {
63+
}
64+
65+
@Override
66+
public void consumeContent() throws IOException {
67+
}
68+
69+
@Override
70+
public String toString() {
71+
return null;
72+
}
73+
74+
}

‎java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/ByteArrayEntity.java‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
/*
2+
* ====================================================================
3+
* Licensed to the Apache Software Foundation (ASF) under one
4+
* or more contributor license agreements. See the NOTICE file
5+
* distributed with this work for additional information
6+
* regarding copyright ownership. The ASF licenses this file
7+
* to you under the Apache License, Version 2.0 (the
8+
* "License"); you may not use this file except in compliance
9+
* with the License. You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing,
14+
* software distributed under the License is distributed on an
15+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
* KIND, either express or implied. See the License for the
17+
* specific language governing permissions and limitations
18+
* under the License.
19+
* ====================================================================
20+
*
21+
* This software consists of voluntary contributions made by many
22+
* individuals on behalf of the Apache Software Foundation. For more
23+
* information on the Apache Software Foundation, please see
24+
* <http://www.apache.org/>.
25+
*
26+
*/
27+
28+
package org.apache.http.entity;
29+
30+
import java.io.ByteArrayInputStream;
31+
import java.io.IOException;
32+
import java.io.InputStream;
33+
import java.io.OutputStream;
34+
35+
36+
public class ByteArrayEntity extends AbstractHttpEntity implements Cloneable {
37+
public ByteArrayEntity(final byte[] b, final ContentType contentType) {
38+
}
39+
40+
public ByteArrayEntity(final byte[] b, final int off, final int len, final ContentType contentType) {
41+
}
42+
43+
public ByteArrayEntity(final byte[] b) {
44+
}
45+
46+
public ByteArrayEntity(final byte[] b, final int off, final int len) {
47+
}
48+
49+
@Override
50+
public boolean isRepeatable() {
51+
return false;
52+
}
53+
54+
@Override
55+
public long getContentLength() {
56+
return 0;
57+
}
58+
59+
@Override
60+
public InputStream getContent() {
61+
return null;
62+
}
63+
64+
@Override
65+
public void writeTo(final OutputStream outStream) throws IOException {
66+
}
67+
68+
@Override
69+
public boolean isStreaming() {
70+
return false;
71+
}
72+
73+
@Override
74+
public Object clone() throws CloneNotSupportedException {
75+
return null;
76+
}
77+
78+
}

0 commit comments

Comments
 (0)