Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9b6213d

Browse files
joefarebrotherjoefarebrother
committed
Convert existing spring http steps to csv
1 parent d34e748 commit 9b6213d

3 files changed

Lines changed: 39 additions & 29 deletions

File tree

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ private module Frameworks {
104104
private import semmle.code.java.frameworks.MyBatis
105105
private import semmle.code.java.frameworks.Hibernate
106106
private import semmle.code.java.frameworks.jOOQ
107+
private import semmle.code.java.frameworks.spring.SpringHttp
107108
}
108109

109110
private predicate sourceModelCsv(string row) {

‎java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -209,22 +209,6 @@ private predicate constructorStep(Expr tracked, ConstructorCall sink) {
209209
// a custom InputStream that wraps a tainted data source is tainted
210210
inputStreamWrapper(sink.getConstructor(), argi)
211211
or
212-
// A SpringHttpEntity is a wrapper around a body and some headers
213-
// Track flow through iff body is a String
214-
exists(SpringHttpEntity she |
215-
sink.getConstructor() = she.getAConstructor() and
216-
argi = 0 and
217-
tracked.getType() instanceof TypeString
218-
)
219-
or
220-
// A SpringRequestEntity is a wrapper around a body and some headers
221-
// Track flow through iff body is a String
222-
exists(SpringResponseEntity sre |
223-
sink.getConstructor() = sre.getAConstructor() and
224-
argi = 0 and
225-
tracked.getType() instanceof TypeString
226-
)
227-
or
228212
sink.getConstructor().(TaintPreservingCallable).returnsTaintFrom(argToParam(sink, argi))
229213
)
230214
}
@@ -277,19 +261,6 @@ private predicate taintPreservingQualifierToMethod(Method m) {
277261
m.getDeclaringType().getASubtype*() instanceof SpringUntrustedDataType and
278262
not m.getDeclaringType() instanceof TypeObject
279263
or
280-
m.getDeclaringType() instanceof SpringHttpEntity and
281-
m.getName().regexpMatch("getBody|getHeaders")
282-
or
283-
exists(SpringHttpHeaders headers | m = headers.getAMethod() |
284-
m.getReturnType() instanceof TypeString
285-
or
286-
exists(ParameterizedType stringlist |
287-
m.getReturnType().(RefType).getASupertype*() = stringlist and
288-
stringlist.getSourceDeclaration().hasQualifiedName("java.util", "List") and
289-
stringlist.getTypeArgument(0) instanceof TypeString
290-
)
291-
)
292-
or
293264
m.(TaintPreservingCallable).returnsTaintFrom(-1)
294265
or
295266
exists(JaxRsResourceMethod resourceMethod |

‎java/ql/src/semmle/code/java/frameworks/spring/SpringHttp.qll‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,41 @@ private class UrlOpenSink extends SinkModelCsv {
6161
]
6262
}
6363
}
64+
65+
private class SpringHttpFlowStep extends SinkModelCsv {
66+
override predicate row(string row) {
67+
row =
68+
[
69+
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
70+
"org.springframework.http;HttpEntity;false;HttpEntity;(T);;Argument[0];Argument[-1];taint",
71+
"org.springframework.http;HttpEntity;false;HttpEntity;(T,MultiValueMap<String,String>);;Argument[0];Argument[-1];taint",
72+
"org.springframework.http;HttpEntity;false;getBody;;;Argument[-1];ReturnValue;taint",
73+
"org.springframework.http;HttpEntity;false;HttpEntity;getHeaders;;Argument[-1];ReturnValue;taint",
74+
// Constructor with signature (MultiValueMap<String,String>) dependant on collection flow
75+
"org.springframework.http;ResponseEntity;false;ResponseEntity;(T,HttpStatus);;Argument[0];Argument[-1];taint",
76+
"org.springframework.http;ResponseEntity;false;ResponseEntity;(T,MultiValueMap<String,String>,HttpStatus);;Argument[0];Argument[-1];taint",
77+
"org.springframework.http;ResponseEntity;false;ResponseEntity;(T,MultiValueMap<String,String>,int);;Argument[0];Argument[-1];taint",
78+
"org.springframework.http;HttpHeaders;false;get;(Object);Argument[-1];ReturnValue;taint", // Returns List<String>
79+
"org.springframework.http;HttpHeaders;false;getAccessControlAllowHeaders;();Argument[-1];ReturnValue;taint", // Returns List<String>
80+
"org.springframework.http;HttpHeaders;false;getAccessControlAllowOrigin;();Argument[-1];ReturnValue;taint",
81+
"org.springframework.http;HttpHeaders;false;getAccessControlExposeHeaders;();Argument[-1];ReturnValue;taint", // Returns List<String>
82+
"org.springframework.http;HttpHeaders;false;getAccessControlRequestHeaders;();Argument[-1];ReturnValue;taint", // Returns List<String>
83+
"org.springframework.http;HttpHeaders;false;getCacheControl;();Argument[-1];ReturnValue;taint",
84+
"org.springframework.http;HttpHeaders;false;getConnection;();Argument[-1];ReturnValue;taint", // Returns List<String>
85+
"org.springframework.http;HttpHeaders;false;getETag;();Argument[-1];ReturnValue;taint",
86+
"org.springframework.http;HttpHeaders;false;getETagValuesAsList;(String);Argument[-1];ReturnValue;taint", // Returns List<String>
87+
"org.springframework.http;HttpHeaders;false;getFieldValues;(String);Argument[-1];ReturnValue;taint",
88+
"org.springframework.http;HttpHeaders;false;getFirst;(String);Argument[-1];ReturnValue;taint",
89+
"org.springframework.http;HttpHeaders;false;getIfMatch;();Argument[-1];ReturnValue;taint", // Returns List<String>
90+
"org.springframework.http;HttpHeaders;false;getIfNoneMatch;();Argument[-1];ReturnValue;taint", // Returns List<String>
91+
"org.springframework.http;HttpHeaders;false;getLocation;();Argument[-1];ReturnValue;taint",
92+
"org.springframework.http;HttpHeaders;false;getOrEmpty;(Object);Argument[-1];ReturnValue;taint", // Returns List<String>
93+
"org.springframework.http;HttpHeaders;false;getOrigin;();Argument[-1];ReturnValue;taint",
94+
"org.springframework.http;HttpHeaders;false;getPragma;();Argument[-1];ReturnValue;taint",
95+
"org.springframework.http;HttpHeaders;false;getUpgrade;();Argument[-1];ReturnValue;taint",
96+
"org.springframework.http;HttpHeaders;false;getValuesAsList;(String);Argument[-1];ReturnValue;taint", // Returns List<String>
97+
"org.springframework.http;HttpHeaders;false;getVary;();Argument[-1];ReturnValue;taint", // Returns List<String>
98+
""
99+
]
100+
}
101+
}

0 commit comments

Comments
 (0)