/**
 * Models the Xerces XML library.
 */

import cpp
import XML
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.ir.IR

/**
 * A flow state representing the configuration of an `AbstractDOMParser` or
 * `SAXParser` object.
 */
class XercesFlowState extends TXxeFlowState {
  int disabledDefaultEntityResolution;
  int createEntityReferenceNodes;

  XercesFlowState() {
    this = TXercesFlowState(disabledDefaultEntityResolution, createEntityReferenceNodes)
  }

  int getDisabledDefaultEntityResolution() { result = disabledDefaultEntityResolution }

  int getCreateEntityReferenceNodes() { result = createEntityReferenceNodes }

  string toString() { result = "XercesFlowState" }
}

/**
 * Gets a valid flow state for `AbstractDOMParser` or `SAXParser` flow.
 */
predicate encodeXercesFlowState(
  XercesFlowState flowstate, int disabledDefaultEntityResolution, int createEntityReferenceNodes
) {
  flowstate.getDisabledDefaultEntityResolution() = disabledDefaultEntityResolution and
  flowstate.getCreateEntityReferenceNodes() = createEntityReferenceNodes
}

/**
 * The `AbstractDOMParser` class.
 */
class AbstractDomParserClass extends Class {
  AbstractDomParserClass() { this.hasName("AbstractDOMParser") }
}

/**
 * The `XercesDOMParser` class.
 */
class XercesDomParserClass extends Class {
  XercesDomParserClass() { this.hasName("XercesDOMParser") }
}

/**
 * The `XercesDOMParser` interface for the Xerces XML library.
 */
class XercesDomParserLibrary extends XmlLibrary {
  XercesDomParserLibrary() { this = "XercesDomParserLibrary" }

  override predicate configurationSource(DataFlow::Node node, TXxeFlowState flowstate) {
    // source is the write on `this` of a call to the `XercesDOMParser`
    // constructor.
    exists(Call call |
      call.getTarget() = any(XercesDomParserClass c).getAConstructor() and
      node.asExpr() = call and
      encodeXercesFlowState(flowstate, 0, 1) // default configuration
    )
  }

  override predicate configurationSink(DataFlow::Node node, TXxeFlowState flowstate) {
    // sink is the read of the qualifier of a call to `AbstractDOMParser.parse`.
    exists(Call call |
      call.getTarget().getClassAndName("parse") instanceof AbstractDomParserClass and
      call.getQualifier() = node.asIndirectExpr()
    ) and
    flowstate instanceof XercesFlowState and
    not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
  }
}

/**
 * The `DOMLSParser` class.
 */
class DomLSParserClass extends Class {
  DomLSParserClass() { this.hasName("DOMLSParser") }
}

/**
 * The `createLSParser` function that returns a newly created `DOMLSParser`
 * object.
 */
class CreateLSParser extends Function {
  CreateLSParser() {
    this.hasName("createLSParser") and
    this.getUnspecifiedType().(PointerType).getBaseType() instanceof DomLSParserClass // returns a `DOMLSParser *`.
  }
}

/**
 * The createLSParser interface for the Xerces XML library.
 */
class CreateLSParserLibrary extends XmlLibrary {
  CreateLSParserLibrary() { this = "CreateLSParserLibrary" }

  override predicate configurationSource(DataFlow::Node node, TXxeFlowState flowstate) {
    // source is the result of a call to `createLSParser`.
    exists(Call call |
      call.getTarget() instanceof CreateLSParser and
      call = node.asIndirectExpr() and
      encodeXercesFlowState(flowstate, 0, 1) // default configuration
    )
  }

  override predicate configurationSink(DataFlow::Node node, TXxeFlowState flowstate) {
    // sink is the read of the qualifier of a call to `DOMLSParserClass.parse`.
    exists(Call call |
      call.getTarget().getClassAndName("parse") instanceof DomLSParserClass and
      call.getQualifier() = node.asIndirectExpr()
    ) and
    flowstate instanceof XercesFlowState and
    not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
  }
}

/**
 * The `SAXParser` class.
 */
class SaxParserClass extends Class {
  SaxParserClass() { this.hasName("SAXParser") }
}

/**
 * The `SAX2XMLReader` class.
 */
class Sax2XmlReader extends Class {
  Sax2XmlReader() { this.hasName("SAX2XMLReader") }
}

/**
 * The SAXParser interface for the Xerces XML library.
 */
class SaxParserLibrary extends XmlLibrary {
  SaxParserLibrary() { this = "SaxParserLibrary" }

  override predicate configurationSource(DataFlow::Node node, TXxeFlowState flowstate) {
    // source is the write on `this` of a call to the `SAXParser`
    // constructor.
    exists(Call call |
      call.getTarget() = any(SaxParserClass c).getAConstructor() and
      node.asExpr() = call and
      encodeXercesFlowState(flowstate, 0, 1) // default configuration
    )
  }

  override predicate configurationSink(DataFlow::Node node, TXxeFlowState flowstate) {
    // sink is the read of the qualifier of a call to `SAXParser.parse`.
    exists(Call call |
      call.getTarget().getClassAndName("parse") instanceof SaxParserClass and
      call.getQualifier() = node.asIndirectExpr()
    ) and
    flowstate instanceof XercesFlowState and
    not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
  }
}

/**
 * The `createXMLReader` function that returns a newly created `SAX2XMLReader`
 * object.
 */
class CreateXmlReader extends Function {
  CreateXmlReader() {
    this.hasName("createXMLReader") and
    this.getUnspecifiedType().(PointerType).getBaseType() instanceof Sax2XmlReader // returns a `SAX2XMLReader *`.
  }
}

/**
 * The SAX2XMLReader interface for the Xerces XML library.
 */
class Sax2XmlReaderLibrary extends XmlLibrary {
  Sax2XmlReaderLibrary() { this = "Sax2XmlReaderLibrary" }

  override predicate configurationSource(DataFlow::Node node, TXxeFlowState flowstate) {
    // source is the result of a call to `createXMLReader`.
    exists(Call call |
      call.getTarget() instanceof CreateXmlReader and
      call = node.asIndirectExpr() and
      encodeXercesFlowState(flowstate, 0, 1) // default configuration
    )
  }

  override predicate configurationSink(DataFlow::Node node, TXxeFlowState flowstate) {
    // sink is the read of the qualifier of a call to `SAX2XMLReader.parse`.
    exists(Call call |
      call.getTarget().getClassAndName("parse") instanceof Sax2XmlReader and
      call.getQualifier() = node.asIndirectExpr()
    ) and
    flowstate instanceof XercesFlowState and
    not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
  }
}

/**
 * A flow state transformer for a call to
 * `AbstractDOMParser.setDisableDefaultEntityResolution` or
 * `SAXParser.setDisableDefaultEntityResolution`. Transforms the flow
 * state through the qualifier according to the setting in the parameter.
 */
class DisableDefaultEntityResolutionTransformer extends XxeFlowStateTransformer {
  Expr newValue;

  DisableDefaultEntityResolutionTransformer() {
    exists(Call call, Function f |
      call.getTarget() = f and
      (
        f.getDeclaringType() instanceof AbstractDomParserClass or
        f.getDeclaringType() instanceof SaxParserClass
      ) and
      f.hasName("setDisableDefaultEntityResolution") and
      this = call.getQualifier() and
      newValue = call.getArgument(0)
    )
  }

  final override TXxeFlowState transform(TXxeFlowState flowstate) {
    exists(int createEntityReferenceNodes |
      encodeXercesFlowState(flowstate, _, createEntityReferenceNodes) and
      (
        globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // true
        encodeXercesFlowState(result, 1, createEntityReferenceNodes)
        or
        not globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // false or unknown
        encodeXercesFlowState(result, 0, createEntityReferenceNodes)
      )
    )
  }
}

/**
 * A flow state transformer for a call to
 * `AbstractDOMParser.setCreateEntityReferenceNodes`. Transforms the flow
 * state through the qualifier according to the setting in the parameter.
 */
class CreateEntityReferenceNodesTransformer extends XxeFlowStateTransformer {
  Expr newValue;

  CreateEntityReferenceNodesTransformer() {
    exists(Call call, Function f |
      call.getTarget() = f and
      f.getClassAndName("setCreateEntityReferenceNodes") instanceof AbstractDomParserClass and
      this = call.getQualifier() and
      newValue = call.getArgument(0)
    )
  }

  final override TXxeFlowState transform(TXxeFlowState flowstate) {
    exists(int disabledDefaultEntityResolution |
      encodeXercesFlowState(flowstate, disabledDefaultEntityResolution, _) and
      (
        globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // true
        encodeXercesFlowState(result, disabledDefaultEntityResolution, 1)
        or
        not globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // false or unknown
        encodeXercesFlowState(result, disabledDefaultEntityResolution, 0)
      )
    )
  }
}

/**
 * The `XMLUni.fgXercesDisableDefaultEntityResolution` constant.
 */
class FeatureDisableDefaultEntityResolution extends Variable {
  FeatureDisableDefaultEntityResolution() {
    this.getName() = "fgXercesDisableDefaultEntityResolution" and
    this.getDeclaringType().getName() = "XMLUni"
  }
}

/**
 * A flow state transformer for a call to `SAX2XMLReader.setFeature`
 * specifying the feature `XMLUni::fgXercesDisableDefaultEntityResolution`.
 * Transforms the flow state through the qualifier according to this setting.
 */
class SetFeatureTransformer extends XxeFlowStateTransformer {
  Expr newValue;

  SetFeatureTransformer() {
    exists(Call call, Function f |
      call.getTarget() = f and
      f.getClassAndName("setFeature") instanceof Sax2XmlReader and
      this = call.getQualifier() and
      globalValueNumber(call.getArgument(0)).getAnExpr().(VariableAccess).getTarget() instanceof
        FeatureDisableDefaultEntityResolution and
      newValue = call.getArgument(1)
    )
  }

  final override TXxeFlowState transform(TXxeFlowState flowstate) {
    exists(int createEntityReferenceNodes |
      encodeXercesFlowState(flowstate, _, createEntityReferenceNodes) and
      (
        globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // true
        encodeXercesFlowState(result, 1, createEntityReferenceNodes)
        or
        not globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // false or unknown
        encodeXercesFlowState(result, 0, createEntityReferenceNodes)
      )
    )
  }
}

/**
 * The `DOMLSParser.getDomConfig` function.
 */
class GetDomConfig extends Function {
  GetDomConfig() { this.getClassAndName("getDomConfig") instanceof DomLSParserClass }
}

/**
 * The `DOMConfiguration.setParameter` function.
 */
class DomConfigurationSetParameter extends Function {
  DomConfigurationSetParameter() {
    this.getClassAndName("setParameter").getName() = "DOMConfiguration"
  }
}

/**
 * A flow state transformer for a call to `DOMConfiguration.setParameter`
 * specifying the feature `XMLUni::fgXercesDisableDefaultEntityResolution`.
 * This is a slightly more complex transformer because the qualifier is a
 * `DOMConfiguration` pointer returned by `DOMLSParser.getDomConfig` - and it
 * is *that* qualifier we want to transform the flow state of.
 */
class DomConfigurationSetParameterTransformer extends XxeFlowStateTransformer {
  Expr newValue;

  DomConfigurationSetParameterTransformer() {
    exists(FunctionCall getDomConfigCall, FunctionCall setParameterCall |
      // this is the qualifier of a call to `DOMLSParser.getDomConfig`.
      getDomConfigCall.getTarget() instanceof GetDomConfig and
      this = getDomConfigCall.getQualifier() and
      // `setParameterCall` is a call to `setParameter` on the return value of
      // the same call to `DOMLSParser.getDomConfig`.
      setParameterCall.getTarget() instanceof DomConfigurationSetParameter and
      globalValueNumber(setParameterCall.getQualifier()).getAnExpr() = getDomConfigCall and
      // the parameter being set is
      // `XMLUni::fgXercesDisableDefaultEntityResolution`.
      globalValueNumber(setParameterCall.getArgument(0)).getAnExpr().(VariableAccess).getTarget()
        instanceof FeatureDisableDefaultEntityResolution and
      // the value being set is `newValue`.
      newValue = setParameterCall.getArgument(1)
    )
  }

  final override TXxeFlowState transform(TXxeFlowState flowstate) {
    exists(int createEntityReferenceNodes |
      encodeXercesFlowState(flowstate, _, createEntityReferenceNodes) and
      (
        globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // true
        encodeXercesFlowState(result, 1, createEntityReferenceNodes)
        or
        not globalValueNumber(newValue).getAnExpr().getValue().toInt() = 1 and // false or unknown
        encodeXercesFlowState(result, 0, createEntityReferenceNodes)
      )
    )
  }
}