Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7674535

Browse files
smowtonsmowton
authored
Merge pull request #8032 from JLLeitschuh/feat/JLL/check_os
Java: Add Guard Classes for checking OS & unify System Property Access
2 parents 929419a + b11340c commit 7674535

36 files changed

Lines changed: 3222 additions & 169 deletions

‎java/ql/lib/semmle/code/java/JDK.qll‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
import Member
66
import semmle.code.java.security.ExternalProcess
7+
private import semmle.code.java.dataflow.FlowSteps
78

89
// --- Standard types ---
910
/** The class `java.lang.Object`. */
@@ -37,6 +38,27 @@ class StringLengthMethod extends Method {
3738
StringLengthMethod() { this.hasName("length") and this.getDeclaringType() instanceof TypeString }
3839
}
3940

41+
/**
42+
* The methods on the class `java.lang.String` that are used to perform partial matches with a specified substring or char.
43+
*/
44+
class StringPartialMatchMethod extends Method {
45+
StringPartialMatchMethod() {
46+
this.hasName([
47+
"contains", "startsWith", "endsWith", "matches", "indexOf", "lastIndexOf", "regionMatches"
48+
]) and
49+
this.getDeclaringType() instanceof TypeString
50+
}
51+
52+
/**
53+
* Gets the index of the parameter that is being matched against.
54+
*/
55+
int getMatchParameterIndex() {
56+
if this.hasName("regionMatches")
57+
then this.getParameterType(result) instanceof TypeString
58+
else result = 0
59+
}
60+
}
61+
4062
/** The class `java.lang.StringBuffer`. */
4163
class TypeStringBuffer extends Class {
4264
TypeStringBuffer() { this.hasQualifiedName("java.lang", "StringBuffer") }
@@ -228,11 +250,13 @@ class MethodSystemGetenv extends Method {
228250
/**
229251
* Any method named `getProperty` on class `java.lang.System`.
230252
*/
231-
class MethodSystemGetProperty extends Method {
253+
class MethodSystemGetProperty extends ValuePreservingMethod {
232254
MethodSystemGetProperty() {
233255
this.hasName("getProperty") and
234256
this.getDeclaringType() instanceof TypeSystem
235257
}
258+
259+
override predicate returnsValue(int arg) { arg = 1 }
236260
}
237261

238262
/**
@@ -244,6 +268,9 @@ class MethodAccessSystemGetProperty extends MethodAccess {
244268
/**
245269
* Holds if this call has a compile-time constant first argument with the value `propertyName`.
246270
* For example: `System.getProperty("user.dir")`.
271+
*
272+
* Note: Better to use `semmle.code.java.environment.SystemProperty#getSystemProperty` instead
273+
* as that predicate covers ways of accessing the same information via various libraries.
247274
*/
248275
predicate hasCompileTimeConstantGetPropertyName(string propertyName) {
249276
this.getArgument(0).(CompileTimeConstantExpr).getStringValue() = propertyName

‎java/ql/lib/semmle/code/java/StringFormat.qll‎

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
import java
66
import dataflow.DefUse
7+
private import semmle.code.java.environment.SystemProperty
78

89
/**
910
* A library method that formats a number of its arguments according to a
@@ -312,27 +313,7 @@ private predicate formatStringValue(Expr e, string fmtvalue) {
312313
or
313314
formatStringValue(e.(ChooseExpr).getAResultExpr(), fmtvalue)
314315
or
315-
exists(Method getprop, MethodAccess ma, string prop |
316-
e = ma and
317-
ma.getMethod() = getprop and
318-
getprop.hasName("getProperty") and
319-
getprop.getDeclaringType().hasQualifiedName("java.lang", "System") and
320-
getprop.getNumberOfParameters() = 1 and
321-
ma.getAnArgument().(StringLiteral).getValue() = prop and
322-
(prop = "line.separator" or prop = "file.separator" or prop = "path.separator") and
323-
fmtvalue = "x" // dummy value
324-
)
325-
or
326-
exists(Field f |
327-
e = f.getAnAccess() and
328-
f.getDeclaringType() instanceof TypeFile and
329-
fmtvalue = "x" // dummy value
330-
|
331-
f.hasName("pathSeparator") or
332-
f.hasName("pathSeparatorChar") or
333-
f.hasName("separator") or
334-
f.hasName("separatorChar")
335-
)
316+
e = getSystemProperty(["line.separator", "file.separator", "path.separator"]) and fmtvalue = "x" // dummy value
336317
)
337318
}
338319

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ class EnvReadMethod extends Method {
203203
EnvReadMethod() {
204204
this instanceof MethodSystemGetenv or
205205
this instanceof PropertiesGetPropertyMethod or
206+
this instanceof PropertiesGetMethod or
206207
this instanceof MethodSystemGetProperty
207208
}
208209
}

‎java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ private import semmle.code.java.dataflow.DataFlow
1010
* ensuring that they are visible to the taint tracking library.
1111
*/
1212
private module Frameworks {
13+
private import semmle.code.java.JDK
1314
private import semmle.code.java.frameworks.jackson.JacksonSerializability
1415
private import semmle.code.java.frameworks.android.AsyncTask
1516
private import semmle.code.java.frameworks.android.Intent
1617
private import semmle.code.java.frameworks.android.SQLite
1718
private import semmle.code.java.frameworks.Guice
19+
private import semmle.code.java.frameworks.Properties
1820
private import semmle.code.java.frameworks.Protobuf
1921
private import semmle.code.java.frameworks.guava.Guava
2022
private import semmle.code.java.frameworks.apache.Lang

0 commit comments

Comments
 (0)