Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e23162d

Browse files
joefarebrotherjoefarebrother
committed
Add test cases for PolynomialRedos dataflow logic; make fixes
1 parent 5a4316d commit e23162d

6 files changed

Lines changed: 126 additions & 51 deletions

File tree

‎java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ abstract class RegexMatchMethodAccess extends MethodAccess {
3737
Method m;
3838

3939
RegexMatchMethodAccess() {
40-
this.getMethod().overrides*(m) and
40+
this.getMethod().getSourceDeclaration().overrides*(m) and
4141
m.hasQualifiedName(package, type, name) and
4242
regexArg in [-1 .. m.getNumberOfParameters() - 1] and
4343
stringArg in [-1 .. m.getNumberOfParameters() - 1]
@@ -79,9 +79,9 @@ private class JdkRegexMatchMethodAccess extends RegexMatchMethodAccess {
7979
or
8080
name = "matches" and regexArg = 0 and stringArg = 1
8181
or
82-
name = "split" and regexArg = 0 and stringArg = 1
82+
name = "split" and regexArg = -1 and stringArg = 0
8383
or
84-
name = "splitAsStream" and regexArg = 0 and stringArg = 1
84+
name = "splitAsStream" and regexArg = -1 and stringArg = 0
8585
)
8686
or
8787
package = "java.lang" and
@@ -90,7 +90,7 @@ private class JdkRegexMatchMethodAccess extends RegexMatchMethodAccess {
9090
regexArg = 0 and
9191
stringArg = -1
9292
or
93-
package = "java.util" and
93+
package = "java.util.function" and
9494
type = "Predicate" and
9595
name = "test" and
9696
regexArg = -1 and
@@ -101,7 +101,7 @@ private class JdkRegexMatchMethodAccess extends RegexMatchMethodAccess {
101101
private class JdkRegexFlowStep extends RegexAdditionalFlowStep {
102102
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
103103
exists(MethodAccess ma, Method m, string package, string type, string name, int arg |
104-
ma.getMethod().overrides*(m) and
104+
ma.getMethod().getSourceDeclaration().overrides*(m) and
105105
m.hasQualifiedName(package, type, name) and
106106
node1.asExpr() = argOf(ma, arg) and
107107
node2.asExpr() = ma
@@ -116,7 +116,7 @@ private class JdkRegexFlowStep extends RegexAdditionalFlowStep {
116116
arg = 0
117117
)
118118
or
119-
package = "java.util" and
119+
package = "java.util.function" and
120120
type = "Predicate" and
121121
name = ["and", "or", "not", "negate"] and
122122
arg = [-1, 0]
@@ -126,7 +126,7 @@ private class JdkRegexFlowStep extends RegexAdditionalFlowStep {
126126

127127
private class GuavaRegexMatchMethodAccess extends RegexMatchMethodAccess {
128128
GuavaRegexMatchMethodAccess() {
129-
package = "com.google.common.collect" and
129+
package = "com.google.common.base" and
130130
regexArg = -1 and
131131
stringArg = 0 and
132132
type = ["Splitter", "Splitter$MapSplitter"] and
@@ -137,7 +137,7 @@ private class GuavaRegexMatchMethodAccess extends RegexMatchMethodAccess {
137137
private class GuavaRegexFlowStep extends RegexAdditionalFlowStep {
138138
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
139139
exists(MethodAccess ma, Method m, string package, string type, string name, int arg |
140-
ma.getMethod().overrides*(m) and
140+
ma.getMethod().getSourceDeclaration().overrides*(m) and
141141
m.hasQualifiedName(package, type, name) and
142142
node1.asExpr() = argOf(ma, arg) and
143143
node2.asExpr() = ma

java/ql/test/query-tests/security/CWE-730/Test.java renamed to java/ql/test/query-tests/security/CWE-730/ExpRedosTest.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
21
import java.util.regex.Pattern;
32

4-
class Test {
3+
class ExpRedosTest {
54
static String[] regs = {
65

76
// NOT GOOD; attack: "_" + "__".repeat(100)

‎java/ql/test/query-tests/security/CWE-730/PolyRedosTest.java‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
import java.util.regex.Pattern;
2+
import java.util.function.Predicate;
3+
import javax.servlet.http.HttpServletRequest;
4+
import com.google.common.base.Splitter;
5+
6+
class PolyRedosTest {
7+
void test(HttpServletRequest request) {
8+
String tainted = request.getParameter("inp");
9+
String reg = "a\\.\\d+E?\\d+b";
10+
Predicate<String> dummyPred = (s -> s.length() % 7 == 0);
11+
12+
tainted.matches(reg); // $ hasTaintFlow
13+
tainted.split(reg); // $ hasTaintFlow
14+
tainted.split(reg, 7); // $ hasTaintFlow
15+
Pattern.matches(reg, tainted); // $ hasTaintFlow
16+
Pattern.compile(reg).matcher(tainted).matches(); // $ hasTaintFlow
17+
Pattern.compile(reg).split(tainted); // $ hasTaintFlow
18+
Pattern.compile(reg, Pattern.DOTALL).split(tainted); // $ hasTaintFlow
19+
Pattern.compile(reg).split(tainted, 7); // $ hasTaintFlow
20+
Pattern.compile(reg).splitAsStream(tainted); // $ hasTaintFlow
21+
Pattern.compile(reg).asPredicate().test(tainted); // $ hasTaintFlow
22+
Pattern.compile(reg).asMatchPredicate().negate().and(dummyPred).or(dummyPred).test(tainted); // $ hasTaintFlow
23+
Predicate.not(dummyPred.and(dummyPred.or(Pattern.compile(reg).asPredicate()))).test(tainted); // $ hasTaintFlow
24+
25+
Splitter.on(Pattern.compile(reg)).split(tainted); // $ hasTaintFlow
26+
Splitter.on(reg).split(tainted);
27+
Splitter.onPattern(reg).split(tainted); // $ hasTaintFlow
28+
Splitter.onPattern(reg).splitToList(tainted); // $ hasTaintFlow
29+
Splitter.onPattern(reg).limit(7).omitEmptyStrings().trimResults().split(tainted); // $ hasTaintFlow
30+
Splitter.onPattern(reg).withKeyValueSeparator(" => ").split(tainted); // $ hasTaintFlow
31+
Splitter.on(";").withKeyValueSeparator(reg).split(tainted);
32+
Splitter.on(";").withKeyValueSeparator(Splitter.onPattern(reg)).split(tainted); // $ hasTaintFlow
33+
34+
}
35+
}

‎java/ql/test/query-tests/security/CWE-730/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/guava-30.0

‎java/ql/test/stubs/guava-30.0/com/google/common/base/CharMatcher.java‎

Lines changed: 53 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/guava-30.0/com/google/common/base/Splitter.java‎

Lines changed: 28 additions & 41 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)