Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 64b2d33

Browse files
yh-semmleyh-semmle
committed
Java: add test for Guice framework support
1 parent b0d9c80 commit 64b2d33

6 files changed

Lines changed: 143 additions & 0 deletions

File tree

‎java/ql/test/library-tests/frameworks/guice/GuiceRequestParameters.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import java.util.Map;
2+
3+
import com.google.inject.Provider;
4+
import com.google.inject.servlet.RequestParameters;
5+
6+
public class GuiceRequestParameters {
7+
@RequestParameters
8+
private Map<String,String> paramMap;
9+
@RequestParameters
10+
private Provider<Map<String,String>> providerMap;
11+
12+
void test(String key) {
13+
String s = paramMap.get(key);
14+
sink(s);
15+
String value = providerMap.get().get(key);
16+
sink(value);
17+
}
18+
19+
private void sink(String s) {}
20+
}

‎java/ql/test/library-tests/frameworks/guice/flow.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| GuiceRequestParameters.java:13:14:13:21 | paramMap | GuiceRequestParameters.java:14:8:14:8 | s |
2+
| GuiceRequestParameters.java:15:18:15:28 | providerMap | GuiceRequestParameters.java:16:8:16:12 | value |

‎java/ql/test/library-tests/frameworks/guice/flow.ql‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
import java
2+
import semmle.code.java.dataflow.FlowSources
3+
import semmle.code.java.dataflow.TaintTracking
4+
5+
class Conf extends TaintTracking::Configuration {
6+
Conf() { this = "conf" }
7+
8+
override predicate isSource(DataFlow::Node src) {
9+
src instanceof RemoteUserInput
10+
}
11+
12+
override predicate isSink(DataFlow::Node sink) {
13+
exists(MethodAccess ma |
14+
sink.asExpr() = ma.getAnArgument() and
15+
ma.getMethod().hasName("sink")
16+
) and
17+
sink.asExpr().getFile().getStem() = "GuiceRequestParameters"
18+
}
19+
}
20+
21+
from Conf c, DataFlow::Node src, DataFlow::Node sink
22+
where c.hasFlow(src, sink)
23+
select src, sink

‎java/ql/test/library-tests/frameworks/guice/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/guice-servlet-4.2.2/:${testdir}/../../../stubs/guice-4.2.2/

‎java/ql/test/stubs/guice-4.2.2/com/google/inject/Provider.java‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
* Copyright (C) 2006 Google Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* Adapted from Guice version 4.2.2 as available at
19+
* https://search.maven.org/classic/remotecontent?filepath=com/google/inject/guice/4.2.2/guice-4.2.2-sources.jar
20+
* Only relevant stubs of this file have been retained for test purposes.
21+
*/
22+
23+
package com.google.inject;
24+
25+
/**
26+
* An object capable of providing instances of type {@code T}. Providers are used in numerous ways
27+
* by Guice:
28+
*
29+
* <ul>
30+
* <li>When the default means for obtaining instances (an injectable or parameterless constructor)
31+
* is insufficient for a particular binding, the module can specify a custom {@code Provider}
32+
* instead, to control exactly how Guice creates or obtains instances for the binding.
33+
* <li>An implementation class may always choose to have a {@code Provider<T>} instance injected,
34+
* rather than having a {@code T} injected directly. This may give you access to multiple
35+
* instances, instances you wish to safely mutate and discard, instances which are out of scope
36+
* (e.g. using a {@code @RequestScoped} object from within a {@code @SessionScoped} object), or
37+
* instances that will be initialized lazily.
38+
* <li>A custom {@link Scope} is implemented as a decorator of {@code Provider<T>}, which decides
39+
* when to delegate to the backing provider and when to provide the instance some other way.
40+
* <li>The {@link Injector} offers access to the {@code Provider<T>} it uses to fulfill requests for
41+
* a given key, via the {@link Injector#getProvider} methods.
42+
* </ul>
43+
*
44+
* @param <T> the type of object this provides
45+
* @author [email protected] (Bob Lee)
46+
*/
47+
public interface Provider<T> {
48+
49+
/**
50+
* Provides an instance of {@code T}.
51+
*
52+
* @throws OutOfScopeException when an attempt is made to access a scoped object while the scope
53+
* in question is not currently active
54+
* @throws ProvisionException if an instance cannot be provided. Such exceptions include messages
55+
* and throwables to describe why provision failed.
56+
*/
57+
T get();
58+
}

‎java/ql/test/stubs/guice-servlet-4.2.2/com/google/inject/servlet/RequestParameters.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* Copyright (C) 2006 Google Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* Adapted from Guice Servlet version 4.2.2 as available at
19+
* https://search.maven.org/classic/remotecontent?filepath=com/google/inject/extensions/guice-servlet/4.2.2/guice-servlet-4.2.2-sources.jar
20+
* Only relevant stubs of this file have been retained for test purposes.
21+
*/
22+
23+
package com.google.inject.servlet;
24+
25+
import static java.lang.annotation.RetentionPolicy.RUNTIME;
26+
27+
import java.lang.annotation.ElementType;
28+
import java.lang.annotation.Retention;
29+
import java.lang.annotation.Target;
30+
31+
/**
32+
* Apply this to field or parameters of type {@code Map<String, String[]>} when you want the HTTP
33+
* request parameter map to be injected.
34+
*
35+
* @author [email protected] (Bob Lee)
36+
*/
37+
@Retention(RUNTIME)
38+
@Target({ElementType.FIELD, ElementType.PARAMETER, ElementType.METHOD})
39+
public @interface RequestParameters {}

0 commit comments

Comments
 (0)