Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f412f43

Browse files
atorralbaatorralba
committed
Add thymeleaf steps
1 parent 79a32f1 commit f412f43

8 files changed

Lines changed: 97 additions & 11 deletions

File tree

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ private module Frameworks {
117117
private import semmle.code.java.frameworks.Retrofit
118118
private import semmle.code.java.frameworks.Stream
119119
private import semmle.code.java.frameworks.Strings
120+
private import semmle.code.java.frameworks.Thymeleaf
120121
private import semmle.code.java.frameworks.ratpack.Ratpack
121122
private import semmle.code.java.frameworks.ratpack.RatpackExec
122123
private import semmle.code.java.frameworks.spring.SpringCache

‎java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* Provides classes and predicates for working with the Thymeleaf template engine.
3+
*/
4+
5+
import java
6+
private import semmle.code.java.dataflow.ExternalFlow
7+
8+
private class ThymeleafSummaryModels extends SummaryModelCsv {
9+
override predicate row(string row) {
10+
row =
11+
[
12+
"org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual",
13+
"org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual",
14+
]
15+
}
16+
}

‎java/ql/test/library-tests/frameworks/thymeleaf/Test.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
package generatedtest;
2+
3+
import java.util.Map;
4+
import java.util.Set;
5+
import org.thymeleaf.TemplateSpec;
6+
import org.thymeleaf.templatemode.TemplateMode;
7+
8+
// Test case generated by GenerateFlowTestCase.ql
9+
public class Test {
10+
11+
Object source() { return null; }
12+
void sink(Object o) { }
13+
14+
public void test() throws Exception {
15+
16+
{
17+
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
18+
TemplateSpec out = null;
19+
String in = (String)source();
20+
out = new TemplateSpec(in, (Map)null);
21+
sink(out); // $ hasTaintFlow
22+
}
23+
{
24+
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
25+
TemplateSpec out = null;
26+
String in = (String)source();
27+
out = new TemplateSpec(in, (Set)null, (String)null, (Map)null);
28+
sink(out); // $ hasTaintFlow
29+
}
30+
{
31+
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
32+
TemplateSpec out = null;
33+
String in = (String)source();
34+
out = new TemplateSpec(in, (Set)null, (TemplateMode)null, (Map)null);
35+
sink(out); // $ hasTaintFlow
36+
}
37+
{
38+
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
39+
TemplateSpec out = null;
40+
String in = (String)source();
41+
out = new TemplateSpec(in, (String)null);
42+
sink(out); // $ hasTaintFlow
43+
}
44+
{
45+
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
46+
TemplateSpec out = null;
47+
String in = (String)source();
48+
out = new TemplateSpec(in, (TemplateMode)null);
49+
sink(out); // $ hasTaintFlow
50+
}
51+
{
52+
// "org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual"
53+
String out = null;
54+
TemplateSpec in = (TemplateSpec)source();
55+
out = in.getTemplate();
56+
sink(out); // $ hasTaintFlow
57+
}
58+
59+
}
60+
61+
}

‎java/ql/test/library-tests/frameworks/thymeleaf/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/thymeleaf-3.0.14

‎java/ql/test/library-tests/frameworks/thymeleaf/test.expected‎

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/thymeleaf/test.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import java
2+
import TestUtilities.InlineFlowTest

‎java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,15 @@ public class PebbleSSTI {
1515

1616
@GetMapping(value = "bad1")
1717
public void bad1(HttpServletRequest request) {
18-
String code = request.getParameter("code");
18+
String templateName = request.getParameter("templateName");
1919
PebbleEngine engine = new PebbleEngine.Builder().build();
20-
// public PebbleTemplate getTemplate(String templateName)
21-
PebbleTemplate compiledTemplate = engine.getTemplate(code); // $hasTemplateInjection
20+
PebbleTemplate compiledTemplate = engine.getTemplate(templateName); // $hasTemplateInjection
2221
}
2322

2423
@GetMapping(value = "bad2")
2524
public void bad2(HttpServletRequest request) {
26-
String code = request.getParameter("code");
25+
String templateName = request.getParameter("templateName");
2726
PebbleEngine engine = new PebbleEngine.Builder().build();
28-
// public PebbleTemplate getLiteralTemplate(String templateName)
29-
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(code); // $hasTemplateInjection
27+
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(templateName); // $hasTemplateInjection
3028
}
3129
}

‎java/ql/test/query-tests/security/CWE-094/ThymeleafSSTI.java‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,29 @@
99
import java.io.Reader;
1010
import java.io.StringReader;
1111
import java.io.Writer;
12+
import java.util.Set;
1213

1314
import org.thymeleaf.*;
1415
import org.thymeleaf.context.Context;
1516

1617
@Controller
1718
public class ThymeleafSSTI {
18-
String sourceName = "sourceName";
19-
2019
@GetMapping(value = "bad1")
2120
public void bad1(HttpServletRequest request) {
2221
String code = request.getParameter("code");
23-
Context ctx = new Context();
2422
try {
25-
FileWriter fw = new FileWriter(new File("as"));
2623
TemplateEngine templateEngine = new TemplateEngine();
27-
templateEngine.process(code, ctx, fw); // $hasTemplateInjection
24+
templateEngine.process(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
25+
templateEngine.process(code, (Set<String>) null, (Context) null, (Writer) null); // $hasTemplateInjection
26+
templateEngine.process(code, (Context) null); // $hasTemplateInjection
27+
templateEngine.process(code, (Context) null, (Writer) null); // $hasTemplateInjection
28+
templateEngine.processThrottled(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
29+
templateEngine.processThrottled(code, (Context) null); // $hasTemplateInjection
30+
31+
TemplateSpec spec = new TemplateSpec(code, "");
32+
templateEngine.process(spec, (Context) null); // $hasTemplateInjection
33+
templateEngine.process(spec, (Context) null, (Writer) null); // $hasTemplateInjection
34+
templateEngine.processThrottled(spec, (Context) null); // $hasTemplateInjection
2835
} catch (Exception e) {
2936
}
3037
}

0 commit comments

Comments
 (0)