Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b99a1d2

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
update sink and tests
1 parent e49c521 commit b99a1d2

3 files changed

Lines changed: 21 additions & 11 deletions

File tree

‎java/ql/lib/semmle/code/java/regex/RegexFlowModels.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ private class RegexSinkCsv extends SinkModelCsv {
2727
"com.google.common.base;Splitter;false;split;(CharSequence);;Argument[-1];regex-use[0];manual",
2828
"com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[-1];regex-use[0];manual",
2929
"com.google.common.base;Splitter$MapSplitter;false;split;(CharSequence);;Argument[-1];regex-use[0];manual",
30-
"org.apache.commons.lang3;RegExUtils;false;removeAll;(String,String);;Argument[1];regex-use[0];manual",
31-
"org.apache.commons.lang3;RegExUtils;false;removeFirst;(String,String);;Argument[1];regex-use[0];manual",
32-
"org.apache.commons.lang3;RegExUtils;false;removePattern;(String,String);;Argument[1];regex-use[0];manual",
33-
"org.apache.commons.lang3;RegExUtils;false;replaceAll;(String,String,String);;Argument[1];regex-use[0];manual",
34-
"org.apache.commons.lang3;RegExUtils;false;replaceFirst;(String,String,String);;Argument[1];regex-use[0];manual",
35-
"org.apache.commons.lang3;RegExUtils;false;replacePattern;(String,String,String);;Argument[1];regex-use[0];manual",
30+
"org.apache.commons.lang3;RegExUtils;false;removeAll;(String,String);;Argument[1];regex-use;manual",
31+
"org.apache.commons.lang3;RegExUtils;false;removeFirst;(String,String);;Argument[1];regex-use;manual",
32+
"org.apache.commons.lang3;RegExUtils;false;removePattern;(String,String);;Argument[1];regex-use;manual",
33+
"org.apache.commons.lang3;RegExUtils;false;replaceAll;(String,String,String);;Argument[1];regex-use;manual",
34+
"org.apache.commons.lang3;RegExUtils;false;replaceFirst;(String,String,String);;Argument[1];regex-use;manual",
35+
"org.apache.commons.lang3;RegExUtils;false;replacePattern;(String,String,String);;Argument[1];regex-use;manual",
3636
]
3737
}
3838
}

‎java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@ abstract class RegexInjectionSanitizer extends DataFlow::ExprNode { }
1515
private class DefaultRegexInjectionSink extends RegexInjectionSink {
1616
DefaultRegexInjectionSink() {
1717
exists(string kind |
18-
kind.matches([
19-
"regex-use[]", "regex-use[f1]", "regex-use[f-1]", "regex-use[-1]", "regex-use[0]"
20-
]) and
18+
kind.matches(["regex-use[]", "regex-use[f1]", "regex-use[f-1]", "regex-use[-1]", "regex-use"]) and
2119
sinkNode(this, kind)
2220
)
2321
}

‎java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.java‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import javax.servlet.ServletException;
88

99
import org.apache.commons.lang3.RegExUtils;
10+
import com.google.common.base.Splitter;
1011

1112
public class RegexInjectionTest extends HttpServlet {
1213
public boolean string1(javax.servlet.http.HttpServletRequest request) {
@@ -138,10 +139,10 @@ public boolean apache7(javax.servlet.http.HttpServletRequest request) {
138139

139140
// test `Pattern.quote` sanitizer
140141
public boolean quoteTest(javax.servlet.http.HttpServletRequest request) {
141-
String regex = request.getParameter("regex");
142+
String pattern = request.getParameter("pattern");
142143
String input = request.getParameter("input");
143144

144-
return input.matches(Pattern.quote(regex)); // Safe
145+
return input.matches(Pattern.quote(pattern)); // Safe
145146
}
146147

147148
// test `Pattern.LITERAL` sanitizer
@@ -151,4 +152,15 @@ public boolean literalTest(javax.servlet.http.HttpServletRequest request) {
151152

152153
return Pattern.compile(pattern, Pattern.LITERAL).matcher(input).matches(); // Safe
153154
}
155+
156+
public Splitter guava1(javax.servlet.http.HttpServletRequest request) {
157+
String pattern = request.getParameter("pattern");
158+
return Splitter.onPattern(pattern); // $ hasRegexInjection
159+
}
160+
161+
public Splitter guava2(javax.servlet.http.HttpServletRequest request) {
162+
String pattern = request.getParameter("pattern");
163+
// sink is `Pattern.compile`
164+
return Splitter.on(Pattern.compile(pattern)); // $ hasRegexInjection
165+
}
154166
}

0 commit comments

Comments
 (0)