merge all ne flow sources into one by extending current abstract class

am0o0 · am0o0 · commit d31711bd89c3 · 2024-07-01T15:16:44.000+02:00
diff --git a/java/ql/src/experimental/Security/CWE/CWE-522-DecompressionBombs/DecompressionBomb.ql b/java/ql/src/experimental/Security/CWE/CWE-522-DecompressionBombs/DecompressionBomb.ql
@@ -1,6 +1,6 @@
 /**
  * @name Uncontrolled file decompression
- * @description Uncontrolled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @description Decompressing user-controlled files without checking the compression ratio may allow attackers to perform denial-of-service attacks.
  * @kind path-problem
  * @problem.severity error
  * @security-severity 7.8
@@ -20,13 +20,7 @@ module DecompressionBombsConfig implements DataFlow::StateConfigSig {
   class FlowState = DecompressionState;
 
   predicate isSource(DataFlow::Node source, FlowState state) {
-    (
-      source instanceof RemoteFlowSource
-      or
-      source instanceof FormRemoteFlowSource
-      or
-      source instanceof FileUploadRemoteFlowSource
-    ) and
+    source instanceof RemoteFlowSource and
     (
       state instanceof ZipFile
       or
diff --git a/java/ql/src/experimental/semmle/code/java/security/FileAndFormRemoteSource.qll b/java/ql/src/experimental/semmle/code/java/security/FileAndFormRemoteSource.qll
@@ -1,9 +1,6 @@
 import java
 import semmle.code.java.dataflow.DataFlow
-
-abstract class FormRemoteFlowSource extends DataFlow::Node { }
-
-abstract class FileUploadRemoteFlowSource extends DataFlow::Node { }
+import semmle.code.java.dataflow.FlowSources
 
 class CommonsFileUploadAdditionalTaintStep extends Unit {
   abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
@@ -30,17 +27,19 @@ module ApacheCommonsFileUpload {
       }
     }
 
-    class ServletFileUpload extends FileUploadRemoteFlowSource {
+    class ServletFileUpload extends RemoteFlowSource {
       ServletFileUpload() {
         exists(MethodAccess ma |
           ma.getReceiverType() instanceof TypeServletFileUpload and
           ma.getCallee().hasName(["parseRequest"]) and
           this.asExpr() = ma
         )
       }
+
+      override string getSourceType() { result = "Apache Commons Fileupload" }
     }
 
-    private class FileItemRemoteSource extends FileUploadRemoteFlowSource {
+    private class FileItemRemoteSource extends RemoteFlowSource {
       FileItemRemoteSource() {
         exists(MethodAccess ma |
           ma.getReceiverType() instanceof TypeFileUpload and
@@ -51,16 +50,20 @@ module ApacheCommonsFileUpload {
           this.asExpr() = ma
         )
       }
+
+      override string getSourceType() { result = "Apache Commons Fileupload" }
     }
 
-    private class FileItemStreamRemoteSource extends FileUploadRemoteFlowSource {
+    private class FileItemStreamRemoteSource extends RemoteFlowSource {
       FileItemStreamRemoteSource() {
         exists(MethodAccess ma |
           ma.getReceiverType() instanceof TypeFileItemStream and
           ma.getCallee().hasName(["getContentType", "getFieldName", "getName", "openStream"]) and
           this.asExpr() = ma
         )
       }
+
+      override string getSourceType() { result = "Apache Commons Fileupload" }
     }
   }
 
@@ -98,7 +101,7 @@ module ServletRemoteMultiPartSources {
     TypePart() { this.hasQualifiedName(["javax.servlet.http", "jakarta.servlet.http"], "Part") }
   }
 
-  private class ServletPartCalls extends FormRemoteFlowSource {
+  private class ServletPartCalls extends RemoteFlowSource {
     ServletPartCalls() {
       exists(MethodAccess ma |
         ma.getReceiverType() instanceof TypePart and
@@ -110,5 +113,7 @@ module ServletRemoteMultiPartSources {
         this.asExpr() = ma
       )
     }
+
+    override string getSourceType() { result = "Javax Servlet Http" }
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -1,9 +1,6 @@`
`1`	`1`	`import java`
`2`	`2`	`import semmle.code.java.dataflow.DataFlow`
`3`		`-`
`4`		`-abstract class FormRemoteFlowSource extends DataFlow::Node { }`
`5`		`-`
`6`		`-abstract class FileUploadRemoteFlowSource extends DataFlow::Node { }`
	`3`	`+import semmle.code.java.dataflow.FlowSources`
`7`	`4`
`8`	`5`	`class CommonsFileUploadAdditionalTaintStep extends Unit {`
`9`	`6`	`abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);`
`@@ -30,17 +27,19 @@ module ApacheCommonsFileUpload {`
`30`	`27`	`}`
`31`	`28`	`}`
`32`	`29`
`33`		`- class ServletFileUpload extends FileUploadRemoteFlowSource {`
	`30`	`+ class ServletFileUpload extends RemoteFlowSource {`
`34`	`31`	`ServletFileUpload() {`
`35`	`32`	`exists(MethodAccess ma \|`
`36`	`33`	`ma.getReceiverType() instanceof TypeServletFileUpload and`
`37`	`34`	`ma.getCallee().hasName(["parseRequest"]) and`
`38`	`35`	`this.asExpr() = ma`
`39`	`36`	`)`
`40`	`37`	`}`
	`38`	`+`
	`39`	`+ override string getSourceType() { result = "Apache Commons Fileupload" }`
`41`	`40`	`}`
`42`	`41`
`43`		`- private class FileItemRemoteSource extends FileUploadRemoteFlowSource {`
	`42`	`+ private class FileItemRemoteSource extends RemoteFlowSource {`
`44`	`43`	`FileItemRemoteSource() {`
`45`	`44`	`exists(MethodAccess ma \|`
`46`	`45`	`ma.getReceiverType() instanceof TypeFileUpload and`
`@@ -51,16 +50,20 @@ module ApacheCommonsFileUpload {`
`51`	`50`	`this.asExpr() = ma`
`52`	`51`	`)`
`53`	`52`	`}`
	`53`	`+`
	`54`	`+ override string getSourceType() { result = "Apache Commons Fileupload" }`
`54`	`55`	`}`
`55`	`56`
`56`		`- private class FileItemStreamRemoteSource extends FileUploadRemoteFlowSource {`
	`57`	`+ private class FileItemStreamRemoteSource extends RemoteFlowSource {`
`57`	`58`	`FileItemStreamRemoteSource() {`
`58`	`59`	`exists(MethodAccess ma \|`
`59`	`60`	`ma.getReceiverType() instanceof TypeFileItemStream and`
`60`	`61`	`ma.getCallee().hasName(["getContentType", "getFieldName", "getName", "openStream"]) and`
`61`	`62`	`this.asExpr() = ma`
`62`	`63`	`)`
`63`	`64`	`}`
	`65`	`+`
	`66`	`+ override string getSourceType() { result = "Apache Commons Fileupload" }`
`64`	`67`	`}`
`65`	`68`	`}`
`66`	`69`
`@@ -98,7 +101,7 @@ module ServletRemoteMultiPartSources {`
`98`	`101`	`TypePart() { this.hasQualifiedName(["javax.servlet.http", "jakarta.servlet.http"], "Part") }`
`99`	`102`	`}`
`100`	`103`
`101`		`- private class ServletPartCalls extends FormRemoteFlowSource {`
	`104`	`+ private class ServletPartCalls extends RemoteFlowSource {`
`102`	`105`	`ServletPartCalls() {`
`103`	`106`	`exists(MethodAccess ma \|`
`104`	`107`	`ma.getReceiverType() instanceof TypePart and`
`@@ -110,5 +113,7 @@ module ServletRemoteMultiPartSources {`
`110`	`113`	`this.asExpr() = ma`
`111`	`114`	`)`
`112`	`115`	`}`
	`116`	`+`
	`117`	`+ override string getSourceType() { result = "Javax Servlet Http" }`
`113`	`118`	`}`
`114`	`119`	`}`