Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit adad75b

Browse files
joefarebrotherjoefarebrother
committed
Java: Update Guava modelling to use new refactor
1 parent 8834a8f commit adad75b

6 files changed

Lines changed: 29 additions & 109 deletions

File tree

‎java/ql/src/semmle/code/java/dataflow/FlowSteps.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ module Frameworks {
1515
private import semmle.code.java.frameworks.android.SQLite
1616
private import semmle.code.java.frameworks.Guice
1717
private import semmle.code.java.frameworks.Protobuf
18+
private import semmle.code.java.frameworks.guava.Guava
1819
}
1920

2021
/**

‎java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,9 @@ private import semmle.code.java.security.SecurityTests
77
private import semmle.code.java.security.Validation
88
private import semmle.code.java.Maps
99
private import semmle.code.java.dataflow.internal.ContainerFlow
10-
<<<<<<< HEAD
1110
private import semmle.code.java.frameworks.spring.SpringController
1211
private import semmle.code.java.frameworks.spring.SpringHttp
1312
import semmle.code.java.dataflow.FlowSteps
14-
=======
15-
private import semmle.code.java.frameworks.jackson.JacksonSerializability
16-
private import semmle.code.java.frameworks.guava.Guava
17-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
1813

1914
/**
2015
* Holds if taint can flow from `src` to `sink` in zero or more
@@ -290,11 +285,7 @@ private predicate taintPreservingQualifierToArgument(Method m, int arg) {
290285
m.hasName("read") and
291286
arg = 0
292287
or
293-
<<<<<<< HEAD
294288
m.(TaintPreservingCallable).transfersTaint(-1, arg)
295-
=======
296-
m.(GuavaTaintPropagationMethod).propagatesTaint(-1, arg)
297-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
298289
}
299290

300291
/** Access to a method that passes taint from the qualifier. */
@@ -368,11 +359,7 @@ private predicate taintPreservingQualifierToMethod(Method m) {
368359
)
369360
)
370361
or
371-
<<<<<<< HEAD
372362
m.(TaintPreservingCallable).returnsTaintFrom(-1)
373-
=======
374-
m.(GuavaTaintPropagationMethod).propagatesTaint(-1, -2)
375-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
376363
}
377364

378365
private class StringReplaceMethod extends TaintPreservingCallable {
@@ -490,26 +477,7 @@ private predicate taintPreservingArgumentToMethod(Method method, int arg) {
490477
method.hasName("sourceToInputSource") and
491478
arg = 0
492479
or
493-
<<<<<<< HEAD
494480
method.(TaintPreservingCallable).returnsTaintFrom(arg)
495-
=======
496-
exists(ProtobufParser p | method = p.getAParseFromMethod()) and
497-
arg = 0
498-
or
499-
exists(ProtobufMessageLite m | method = m.getAParseFromMethod()) and
500-
arg = 0
501-
or
502-
// Jackson serialization methods that return the serialized data
503-
method instanceof JacksonWriteValueMethod and
504-
method.getNumberOfParameters() = 1 and
505-
arg = 0
506-
or
507-
method.getDeclaringType().hasQualifiedName("java.io", "StringWriter") and
508-
method.hasName("append") and
509-
arg = 0
510-
or
511-
method.(GuavaTaintPropagationMethod).propagatesTaint(arg, -2)
512-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
513481
}
514482

515483
/**
@@ -557,17 +525,7 @@ private predicate taintPreservingArgToArg(Method method, int input, int output)
557525
input = 0 and
558526
output = 2
559527
or
560-
<<<<<<< HEAD
561528
method.(TaintPreservingCallable).transfersTaint(input, output)
562-
=======
563-
// Jackson serialization methods that write data to the first argument
564-
method instanceof JacksonWriteValueMethod and
565-
method.getNumberOfParameters() > 1 and
566-
input = method.getNumberOfParameters() - 1 and
567-
output = 0
568-
or
569-
method.(GuavaTaintPropagationMethod).propagatesTaint(input, output)
570-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
571529
}
572530

573531
/**
@@ -595,18 +553,7 @@ private predicate taintPreservingArgumentToQualifier(Method method, int arg) {
595553
write.getDeclaringType().hasQualifiedName("java.io", "OutputStream")
596554
)
597555
or
598-
<<<<<<< HEAD
599556
method.(TaintPreservingCallable).transfersTaint(arg, -1)
600-
=======
601-
exists(Method append |
602-
method.overrides*(append) and
603-
append.hasName("append") and
604-
arg = 0 and
605-
append.getDeclaringType().hasQualifiedName("java.io", "StringWriter")
606-
)
607-
or
608-
method.(GuavaTaintPropagationMethod).propagatesTaint(arg, -1)
609-
>>>>>>> 61c00e344... Java: Add modelling for Guava `Strings`, `Splitter`, and `Joiner`
610557
}
611558

612559
/** A comparison or equality test with a constant. */

‎java/ql/src/semmle/code/java/frameworks/guava/Guava.qll‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,3 @@ import java
66
private import Strings
77
private import Splitter
88
private import Joiner
9-
10-
/**
11-
* A method in the guava framework that propegates taint.
12-
*/
13-
abstract class GuavaTaintPropagationMethod extends Method {
14-
/**
15-
* Holds if this method propagates taint between the given source and sink.
16-
* `src` and `sink` are indicies of arguments to this method, or -1 to represent the qualifier.
17-
* `sink` can also be -2 to represent the return value.
18-
*/
19-
abstract predicate propagatesTaint(int src, int sink);
20-
}
21-
22-
/**
23-
* A method in the guava framework that returns tainted data when a specific input
24-
* (either an argument or the qualifier) is tainted.
25-
*/
26-
abstract class GuavaTaintPropagationMethodToReturn extends GuavaTaintPropagationMethod {
27-
/**
28-
* Holds if this method returns tainted data when the given source is tainted.
29-
* `src` is an argument index, or -1 to indicate the qualifier.
30-
*/
31-
abstract predicate propagatesTaint(int src);
32-
33-
override predicate propagatesTaint(int src, int sink) { propagatesTaint(src) and sink = -2 }
34-
}

‎java/ql/src/semmle/code/java/frameworks/guava/Joiner.qll‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import java
6-
import Guava
6+
import semmle.code.java.dataflow.FlowSteps
77

88
/**
99
* The class `com.google.common.base.Joiner`.
@@ -35,8 +35,7 @@ private class GuavaJoinerMethod extends Method {
3535
/**
3636
* A method that builds a `Joiner` or `MapJoiner`.
3737
*/
38-
private class GuavaJoinerBuilderMethod extends GuavaJoinerMethod,
39-
GuavaTaintPropagationMethodToReturn {
38+
private class GuavaJoinerBuilderMethod extends GuavaJoinerMethod, TaintPreservingCallable {
4039
GuavaJoinerBuilderMethod() {
4140
// static Joiner on(char separator)
4241
// static Joiner on(String separator)
@@ -47,13 +46,17 @@ private class GuavaJoinerBuilderMethod extends GuavaJoinerMethod,
4746
this.hasName(["on", "skipNulls", "useForNull", "withKeyValueSeparator"])
4847
}
4948

50-
override predicate propagatesTaint(int src) { src = [-1, 0] }
49+
override predicate returnsTaintFrom(int src) {
50+
src = 0
51+
or
52+
src = -1 and not isStatic()
53+
}
5154
}
5255

5356
/**
5457
* An `appendTo` method on `Joiner` or `MapJoiner`
5558
*/
56-
private class GuavaJoinerAppendToMethod extends GuavaJoinerMethod, GuavaTaintPropagationMethod {
59+
private class GuavaJoinerAppendToMethod extends GuavaJoinerMethod, TaintPreservingCallable {
5760
GuavaJoinerAppendToMethod() {
5861
// <A extends Appendable> A appendTo(A appendable, Iterable<?> parts)
5962
// <A extends Appendable> A appendTo(A appendable, Iterator<?> parts)
@@ -72,17 +75,19 @@ private class GuavaJoinerAppendToMethod extends GuavaJoinerMethod, GuavaTaintPro
7275
this.hasName("appendTo")
7376
}
7477

75-
override predicate propagatesTaint(int src, int sink) {
78+
override predicate transfersTaint(int src, int sink) {
7679
src = [-1 .. getNumberOfParameters()] and
7780
src != sink and
78-
sink = [-2, 0]
81+
sink = 0
7982
}
83+
84+
override predicate returnsTaintFrom(int src) { src = [-1 .. getNumberOfParameters()] }
8085
}
8186

8287
/**
8388
* A `join` method on `Joiner` or `MapJoiner`
8489
*/
85-
private class GuavaJoinMethod extends GuavaJoinerMethod, GuavaTaintPropagationMethodToReturn {
90+
private class GuavaJoinMethod extends GuavaJoinerMethod, TaintPreservingCallable {
8691
GuavaJoinMethod() {
8792
// String join(Iterable<?> parts)
8893
// String join(Iterator<?> parts)
@@ -94,5 +99,5 @@ private class GuavaJoinMethod extends GuavaJoinerMethod, GuavaTaintPropagationMe
9499
this.hasName("join")
95100
}
96101

97-
override predicate propagatesTaint(int src) { src = [-1 .. getNumberOfParameters()] }
102+
override predicate returnsTaintFrom(int src) { src = [-1 .. getNumberOfParameters()] }
98103
}

‎java/ql/src/semmle/code/java/frameworks/guava/Splitter.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import java
6-
import Guava
6+
import semmle.code.java.dataflow.FlowSteps
77

88
/**
99
* The class `com.google.common.base.Splitter`.
@@ -25,7 +25,7 @@ class TypeGuavaMapSplitter extends NestedClass {
2525
/**
2626
* A method of `Splitter` or `MapSplitter` that splits its input string.
2727
*/
28-
private class GuavaSplitMethod extends GuavaTaintPropagationMethodToReturn {
28+
private class GuavaSplitMethod extends TaintPreservingCallable {
2929
GuavaSplitMethod() {
3030
(
3131
this.getDeclaringType() instanceof TypeGuavaSplitter
@@ -39,5 +39,5 @@ private class GuavaSplitMethod extends GuavaTaintPropagationMethodToReturn {
3939
this.hasName(["split", "splitToList", "splitToStream"])
4040
}
4141

42-
override predicate propagatesTaint(int src) { src = 0 }
42+
override predicate returnsTaintFrom(int src) { src = 0 }
4343
}

‎java/ql/src/semmle/code/java/frameworks/guava/Strings.qll‎

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import java
6-
import Guava
6+
import semmle.code.java.dataflow.FlowSteps
77

88
/**
99
* The class `com.google.common.base.Strings`.
@@ -13,31 +13,24 @@ class TypeGuavaStrings extends Class {
1313
}
1414

1515
/**
16-
* A Guava string utility method that preserves taint from its first argument.
16+
* A Guava string utility method that preserves taint.
1717
*/
18-
private class GuavaStringsTaintPropagationMethod extends GuavaTaintPropagationMethodToReturn {
19-
GuavaStringsTaintPropagationMethod() {
18+
private class GuavaStringsTaintPreservingMethod extends TaintPreservingCallable {
19+
GuavaStringsTaintPreservingMethod() {
2020
this.getDeclaringType() instanceof TypeGuavaStrings and
2121
// static String emptyToNull(String string)
2222
// static String emptyToNull(String string)
2323
// static String padEnd(String string, int minLength, char padChar)
2424
// static String padStart(String string, int minLength, char padChar)
2525
// static String repeat(String string, int count)
26-
this.hasName(["emptyToNull", "nullToEmpty", "padStart", "padEnd", "repeat"])
27-
}
28-
29-
override predicate propagatesTaint(int src) { src = 0 }
30-
}
31-
32-
/**
33-
* The method `Strings.lenientFormat`.
34-
*/
35-
private class GuavaStringsFormatMethod extends GuavaTaintPropagationMethodToReturn {
36-
GuavaStringsFormatMethod() {
37-
this.getDeclaringType() instanceof TypeGuavaStrings and
3826
// static String lenientFormat(String template, Object ... args)
39-
this.hasName("lenientFormat")
27+
this.hasName(["emptyToNull", "nullToEmpty", "padStart", "padEnd", "repeat", "lenientFormat"])
4028
}
4129

42-
override predicate propagatesTaint(int src) { src in [0 .. getNumberOfParameters()] }
30+
override predicate returnsTaintFrom(int src) {
31+
src = 0
32+
or
33+
this.hasName("lenientFormat") and
34+
src = [0 .. getNumberOfParameters()]
35+
}
4336
}

0 commit comments

Comments
 (0)