Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit eb1e29d

Browse files
author
Stephan Brandauer
committed
Java: add new endpoint class for source candidates in application mode
1 parent 7cfcbf6 commit eb1e29d

3 files changed

Lines changed: 42 additions & 6 deletions

File tree

‎java/ql/automodel/src/AutomodelApplicationModeCharacteristics.qll‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ newtype TApplicationModeEndpoint =
3535
argExpr.isVararg() and
3636
not exists(int i | i < idx and call.getArgument(i).(Argument).isVararg())
3737
)
38-
}
38+
} or
39+
TMethodCall(Call call) { not call instanceof ConstructorCall }
3940

4041
/**
4142
* An endpoint is a node that is a candidate for modeling.
@@ -122,6 +123,25 @@ class ImplicitVarargsArray extends ApplicationModeEndpoint, TImplicitVarargsArra
122123
override string toString() { result = vararg.toString() }
123124
}
124125

126+
/**
127+
* An endpoint that represents a method call.
128+
*/
129+
class MethodCall extends ApplicationModeEndpoint, TMethodCall {
130+
Call call;
131+
132+
MethodCall() { this = TMethodCall(call) }
133+
134+
override predicate isArgOf(Call c, int idx) { c = call and idx = -1 }
135+
136+
override Top asTop() { result = call }
137+
138+
override DataFlow::Node asNode() { result.asExpr() = call }
139+
140+
override string getExtensibleType() { result = "sourceModel" }
141+
142+
override string toString() { result = call.toString() }
143+
}
144+
125145
/**
126146
* A candidates implementation.
127147
*
@@ -275,6 +295,7 @@ private class UnexploitableIsCharacteristic extends CharacteristicsImpl::NotASin
275295
UnexploitableIsCharacteristic() { this = "unexploitable (is-style boolean method)" }
276296

277297
override predicate appliesToEndpoint(Endpoint e) {
298+
e.getExtensibleType() = "sinkModel" and
278299
not ApplicationCandidatesImpl::isSink(e, _, _) and
279300
ApplicationModeGetCallable::getCallable(e).getName().matches("is%") and
280301
ApplicationModeGetCallable::getCallable(e).getReturnType() instanceof BooleanType
@@ -293,6 +314,7 @@ private class UnexploitableExistsCharacteristic extends CharacteristicsImpl::Not
293314
UnexploitableExistsCharacteristic() { this = "unexploitable (existence-checking boolean method)" }
294315

295316
override predicate appliesToEndpoint(Endpoint e) {
317+
e.getExtensibleType() = "sinkModel" and
296318
not ApplicationCandidatesImpl::isSink(e, _, _) and
297319
exists(Callable callable |
298320
callable = ApplicationModeGetCallable::getCallable(e) and
@@ -309,6 +331,7 @@ private class ExceptionCharacteristic extends CharacteristicsImpl::NotASinkChara
309331
ExceptionCharacteristic() { this = "exception" }
310332

311333
override predicate appliesToEndpoint(Endpoint e) {
334+
e.getExtensibleType() = "sinkModel" and
312335
ApplicationModeGetCallable::getCallable(e).getDeclaringType().getASupertype*() instanceof
313336
TypeThrowable
314337
}
@@ -323,9 +346,13 @@ private class IsMaDTaintStepCharacteristic extends CharacteristicsImpl::NotASink
323346
IsMaDTaintStepCharacteristic() { this = "taint step" }
324347

325348
override predicate appliesToEndpoint(Endpoint e) {
326-
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(e.asNode(), _, _) or
327-
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(e.asNode(), _, _) or
328-
FlowSummaryImpl::Private::Steps::summaryGetterStep(e.asNode(), _, _, _) or
349+
e.getExtensibleType() = "sinkModel" and
350+
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(e.asNode(), _, _)
351+
or
352+
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(e.asNode(), _, _)
353+
or
354+
FlowSummaryImpl::Private::Steps::summaryGetterStep(e.asNode(), _, _, _)
355+
or
329356
FlowSummaryImpl::Private::Steps::summarySetterStep(e.asNode(), _, _, _)
330357
}
331358
}
@@ -340,6 +367,7 @@ private class ArgumentToLocalCall extends CharacteristicsImpl::UninterestingToMo
340367
ArgumentToLocalCall() { this = "argument to local call" }
341368

342369
override predicate appliesToEndpoint(Endpoint e) {
370+
e.getExtensibleType() = "sinkModel" and
343371
ApplicationModeGetCallable::getCallable(e).fromSource()
344372
}
345373
}
@@ -351,6 +379,7 @@ private class ExcludedFromModeling extends CharacteristicsImpl::UninterestingToM
351379
ExcludedFromModeling() { this = "excluded from modeling" }
352380

353381
override predicate appliesToEndpoint(Endpoint e) {
382+
e.getExtensibleType() = "sinkModel" and
354383
ModelExclusions::isUninterestingForModels(ApplicationModeGetCallable::getCallable(e))
355384
}
356385
}
@@ -364,6 +393,7 @@ private class NonPublicMethodCharacteristic extends CharacteristicsImpl::Uninter
364393
NonPublicMethodCharacteristic() { this = "non-public method" }
365394

366395
override predicate appliesToEndpoint(Endpoint e) {
396+
e.getExtensibleType() = "sinkModel" and
367397
not ApplicationModeGetCallable::getCallable(e).isPublic()
368398
}
369399
}
@@ -386,6 +416,7 @@ private class OtherArgumentToModeledMethodCharacteristic extends Characteristics
386416
}
387417

388418
override predicate appliesToEndpoint(Endpoint e) {
419+
e.getExtensibleType() = "sinkModel" and
389420
not ApplicationCandidatesImpl::isSink(e, _, _) and
390421
exists(Endpoint otherSink |
391422
ApplicationCandidatesImpl::isSink(otherSink, _, "manual") and
@@ -403,7 +434,10 @@ private class OtherArgumentToModeledMethodCharacteristic extends Characteristics
403434
private class FunctionValueCharacteristic extends CharacteristicsImpl::LikelyNotASinkCharacteristic {
404435
FunctionValueCharacteristic() { this = "function value" }
405436

406-
override predicate appliesToEndpoint(Endpoint e) { e.asNode().asExpr() instanceof FunctionalExpr }
437+
override predicate appliesToEndpoint(Endpoint e) {
438+
e.getExtensibleType() = "sinkModel" and
439+
e.asNode().asExpr() instanceof FunctionalExpr
440+
}
407441
}
408442

409443
/**
@@ -419,6 +453,7 @@ private class CannotBeTaintedCharacteristic extends CharacteristicsImpl::LikelyN
419453

420454
override predicate appliesToEndpoint(Endpoint e) {
421455
// XXX consider source candidate endpoints
456+
e.getExtensibleType() = "sinkModel" and
422457
not this.isKnownOutNodeForStep(e)
423458
}
424459

‎java/ql/automodel/test/AutomodelApplicationModeExtraction/AutomodelApplicationModeExtractNegativeExamples.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1+
| Test.java:45:10:47:3 | compareTo(...) | known sanitizer\nrelated locations: $@.\nmetadata: $@, $@, $@, $@, $@, $@, $@. | Test.java:45:10:47:3 | compareTo(...) | CallContext | file://java.io:1:1:1:1 | java.io | package | file://File:1:1:1:1 | File | type | file://true:1:1:1:1 | true | subtypes | file://compareTo:1:1:1:1 | compareTo | name | file://(File):1:1:1:1 | (File) | signature | file://Argument[this]:1:1:1:1 | Argument[this] | input | file://false:1:1:1:1 | false | isVarargsArray |
12
| Test.java:46:4:46:5 | f2 | known non-sink\nrelated locations: $@.\nmetadata: $@, $@, $@, $@, $@, $@, $@. | Test.java:45:10:47:3 | compareTo(...) | CallContext | file://java.io:1:1:1:1 | java.io | package | file://File:1:1:1:1 | File | type | file://true:1:1:1:1 | true | subtypes | file://compareTo:1:1:1:1 | compareTo | name | file://(File):1:1:1:1 | (File) | signature | file://Argument[0]:1:1:1:1 | Argument[0] | input | file://false:1:1:1:1 | false | isVarargsArray |
23
| Test.java:52:4:52:4 | p | taint step\nrelated locations: $@.\nmetadata: $@, $@, $@, $@, $@, $@, $@. | Test.java:51:3:56:3 | walk(...) | CallContext | file://java.nio.file:1:1:1:1 | java.nio.file | package | file://Files:1:1:1:1 | Files | type | file://false:1:1:1:1 | false | subtypes | file://walk:1:1:1:1 | walk | name | file://(Path,FileVisitOption[]):1:1:1:1 | (Path,FileVisitOption[]) | signature | file://Argument[0]:1:1:1:1 | Argument[0] | input | file://false:1:1:1:1 | false | isVarargsArray |

‎java/ql/automodel/test/AutomodelApplicationModeExtraction/Test.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public static InputStream getInputStream(String openPath) throws Exception {
4242
}
4343

4444
public static int compareFiles(File f1, File f2) {
45-
return f1.compareTo(
45+
return f1.compareTo( // compareTo call is a known sanitizer
4646
f2 // negative example (modeled as not a sink)
4747
);
4848
}

0 commit comments

Comments
 (0)