Skip to content

Commit 12d1811

Browse files
atorralbaatorralba
authored
Merge pull request github#10533 from pwntester/main
Java: Add support for java.util.StringJoiner
2 parents 3c1456b + 5d80f08 commit 12d1811

File tree

5 files changed

+116
-3
lines changed

5 files changed

+116
-3
lines changed

‎java/ql/lib/change-notes/2022-09-22-stringjoiner-summaries.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added new flow steps for `java.util.StringJoiner`.

‎java/ql/lib/ext/java.util.model.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -338,8 +338,14 @@ extensions:
338338
- ["java.util", "Stack", True, "peek", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
339339
- ["java.util", "Stack", True, "pop", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
340340
- ["java.util", "Stack", True, "push", "(Object)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
341-
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
342-
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
341+
- ["java.util", "StringJoiner", False, "StringJoiner", "", "", "Argument[0..2]", "Argument[this]", "taint", "manual"]
342+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[this]", "ReturnValue", "value", "manual"]
343+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
344+
- ["java.util", "StringJoiner", False, "merge", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
345+
- ["java.util", "StringJoiner", False, "merge", "", "", "Argument[this]", "ReturnValue", "value", "manual"]
346+
- ["java.util", "StringJoiner", False, "setEmptyValue", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
347+
- ["java.util", "StringJoiner", False, "setEmptyValue", "", "", "Argument[this]", "ReturnValue", "value", "manual"]
348+
- ["java.util", "StringJoiner", False, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
343349
- ["java.util", "StringTokenizer", False, "StringTokenizer", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
344350
- ["java.util", "StringTokenizer", False, "nextElement", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
345351
- ["java.util", "StringTokenizer", False, "nextToken", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]

‎java/ql/test/ext/TestModels/Test.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ public void test() throws Exception {
9393
sink(sj1.add((CharSequence)source())); // $hasTaintFlow
9494

9595
StringJoiner sj2 = (StringJoiner)source();
96-
sink(sj2.add("test")); // $hasTaintFlow
96+
sink(sj2.add("test")); // $hasValueFlow
9797
}
9898

9999
// top 300-500 JDK APIs tests

‎java/ql/test/library-tests/dataflow/taint/StringJoinerTests.java

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
import java.util.StringJoiner;
2+
3+
public class StringJoinerTests {
4+
5+
Object taint() {
6+
return null;
7+
}
8+
9+
void sink(Object o) {}
10+
11+
public void test() throws Exception {
12+
{
13+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence);;Argument[0];Argument[-1];taint;manual"
14+
StringJoiner out = null;
15+
CharSequence in = (CharSequence) taint();
16+
out = new StringJoiner(in);
17+
sink(out);
18+
}
19+
{
20+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[-1];taint;manual"
21+
StringJoiner out = null;
22+
CharSequence in = (CharSequence) taint();
23+
out = new StringJoiner(in, null, null);
24+
sink(out);
25+
}
26+
{
27+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[-1];taint;manual"
28+
StringJoiner out = null;
29+
CharSequence in = (CharSequence) taint();
30+
out = new StringJoiner(null, in, null);
31+
sink(out);
32+
}
33+
{
34+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[-1];taint;manual"
35+
StringJoiner out = null;
36+
CharSequence in = (CharSequence) taint();
37+
out = new StringJoiner(null, null, in);
38+
sink(out);
39+
}
40+
{
41+
// "java.util;StringJoiner;false;add;;;Argument[-1];ReturnValue;value;manual"
42+
StringJoiner out = null;
43+
StringJoiner in = (StringJoiner) taint();
44+
out = in.add(null);
45+
sink(out);
46+
}
47+
{
48+
// "java.util;StringJoiner;false;add;;;Argument[0];Argument[-1];taint;manual"
49+
StringJoiner out = null;
50+
CharSequence in = (CharSequence) taint();
51+
out.add(in);
52+
sink(out);
53+
}
54+
{
55+
// "java.util;StringJoiner;false;merge;;;Argument[-1];ReturnValue;value;manual"
56+
StringJoiner out = null;
57+
StringJoiner in = (StringJoiner) taint();
58+
out = in.merge(null);
59+
sink(out);
60+
}
61+
{
62+
// "java.util;StringJoiner;false;merge;;;Argument[0];Argument[-1];taint;manual"
63+
StringJoiner out = null;
64+
StringJoiner in = (StringJoiner) taint();
65+
out.merge(in);
66+
sink(out);
67+
}
68+
{
69+
// "java.util;StringJoiner;false;setEmptyValue;;;Argument[-1];ReturnValue;taint;manual"
70+
StringJoiner out = null;
71+
StringJoiner in = (StringJoiner) taint();
72+
out = in.setEmptyValue(null);
73+
sink(out);
74+
}
75+
{
76+
// "java.util;StringJoiner;false;setEmptyValue;;;Argument[0];Argument[-1];taint;manual"
77+
StringJoiner out = null;
78+
CharSequence in = (CharSequence) taint();
79+
out.setEmptyValue(in);
80+
sink(out);
81+
}
82+
{
83+
// "java.util;StringJoiner;false;toString;;;Argument[-1];ReturnValue;taint;manual"
84+
String out = null;
85+
StringJoiner in = (StringJoiner) taint();
86+
out = in.toString();
87+
sink(out);
88+
}
89+
90+
}
91+
92+
}

‎java/ql/test/library-tests/dataflow/taint/test.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,17 @@
7171
| StringBuilderTests.java:70:15:70:21 | taint(...) | StringBuilderTests.java:73:10:73:26 | new String(...) |
7272
| StringBuilderTests.java:79:15:79:21 | taint(...) | StringBuilderTests.java:80:10:80:40 | toString(...) |
7373
| StringBuilderTests.java:86:15:86:21 | taint(...) | StringBuilderTests.java:87:10:87:27 | substring(...) |
74+
| StringJoinerTests.java:15:37:15:43 | taint(...) | StringJoinerTests.java:17:9:17:11 | out |
75+
| StringJoinerTests.java:22:37:22:43 | taint(...) | StringJoinerTests.java:24:9:24:11 | out |
76+
| StringJoinerTests.java:29:37:29:43 | taint(...) | StringJoinerTests.java:31:9:31:11 | out |
77+
| StringJoinerTests.java:36:37:36:43 | taint(...) | StringJoinerTests.java:38:9:38:11 | out |
78+
| StringJoinerTests.java:43:37:43:43 | taint(...) | StringJoinerTests.java:45:9:45:11 | out |
79+
| StringJoinerTests.java:50:37:50:43 | taint(...) | StringJoinerTests.java:52:9:52:11 | out |
80+
| StringJoinerTests.java:57:37:57:43 | taint(...) | StringJoinerTests.java:59:9:59:11 | out |
81+
| StringJoinerTests.java:64:37:64:43 | taint(...) | StringJoinerTests.java:66:9:66:11 | out |
82+
| StringJoinerTests.java:71:37:71:43 | taint(...) | StringJoinerTests.java:73:9:73:11 | out |
83+
| StringJoinerTests.java:78:37:78:43 | taint(...) | StringJoinerTests.java:80:9:80:11 | out |
84+
| StringJoinerTests.java:85:37:85:43 | taint(...) | StringJoinerTests.java:87:9:87:11 | out |
7485
| Varargs.java:7:8:7:14 | taint(...) | Varargs.java:14:10:14:10 | s |
7586
| Varargs.java:8:8:8:14 | taint(...) | Varargs.java:19:10:19:10 | s |
7687
| Varargs.java:8:17:8:23 | taint(...) | Varargs.java:19:10:19:10 | s |

0 commit comments

Comments
 (0)