Skip to content

Commit 452b9d1

Browse files
atorralbaatorralba
committed
java.net tests
1 parent cad5cd4 commit 452b9d1

File tree

2 files changed

+93
-4
lines changed
  • java/ql/test

2 files changed

+93
-4
lines changed

‎java/ql/test/library-tests/frameworks/jdk/java.net/Test.java

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package generatedtest;
22

3+
import java.net.InetAddress;
4+
import java.net.InetSocketAddress;
35
import java.net.URI;
46
import java.net.URL;
57
import java.net.URLDecoder;
@@ -16,6 +18,27 @@ void sink(Object o) {}
1618

1719
public void test() throws Exception {
1820

21+
{
22+
// "java.net;InetAddress;true;getByName;(String);;Argument[0];ReturnValue;taint;ai-generated"
23+
InetAddress out = null;
24+
String in = (String) source();
25+
out = InetAddress.getByName(in);
26+
sink(out); // $ hasTaintFlow
27+
}
28+
{
29+
// "java.net;InetSocketAddress;true;InetSocketAddress;(String,int);;Argument[0];Argument[-1];taint;ai-generated"
30+
InetSocketAddress out = null;
31+
String in = (String) source();
32+
out = new InetSocketAddress(in, 0);
33+
sink(out); // $ hasTaintFlow
34+
}
35+
{
36+
// "java.net;InetSocketAddress;true;createUnresolved;(String,int);;Argument[0];ReturnValue;taint;ai-generated"
37+
InetSocketAddress out = null;
38+
String in = (String) source();
39+
out = InetSocketAddress.createUnresolved(in, 0);
40+
sink(out); // $ hasTaintFlow
41+
}
1942
{
2043
// "java.net;URI;false;URI;(String);;Argument[0];Argument[-1];taint;manual"
2144
URI out = null;
@@ -30,6 +53,22 @@ public void test() throws Exception {
3053
out = URI.create(in);
3154
sink(out); // $ hasTaintFlow
3255
}
56+
{
57+
// "java.net;URI;false;resolve;(String);;Argument[0];ReturnValue;taint;ai-generated"
58+
URI out = null;
59+
String in = (String) source();
60+
URI instance = null;
61+
out = instance.resolve(in);
62+
sink(out); // $ hasTaintFlow
63+
}
64+
{
65+
// "java.net;URI;false;resolve;(URI);;Argument[0];ReturnValue;taint;ai-generated"
66+
URI out = null;
67+
URI in = (URI) source();
68+
URI instance = null;
69+
out = instance.resolve(in);
70+
sink(out); // $ hasTaintFlow
71+
}
3372
{
3473
// "java.net;URI;false;toASCIIString;;;Argument[-1];ReturnValue;taint;manual"
3574
String out = null;
@@ -58,6 +97,20 @@ public void test() throws Exception {
5897
out = new URL(in);
5998
sink(out); // $ hasTaintFlow
6099
}
100+
{
101+
// "java.net;URL;false;URL;(URL,String);;Argument[0];Argument[-1];taint;ai-generated"
102+
URL out = null;
103+
URL in = (URL) source();
104+
out = new URL(in, null);
105+
sink(out); // $ hasTaintFlow
106+
}
107+
{
108+
// "java.net;URL;false;URL;(URL,String);;Argument[1];Argument[-1];taint;ai-generated"
109+
URL out = null;
110+
String in = (String) source();
111+
out = new URL(null, in);
112+
sink(out); // $ hasTaintFlow
113+
}
61114
{
62115
// "java.net;URL;false;toExternalForm;;;Argument[-1];ReturnValue;taint;manual"
63116
String out = null;

‎java/ql/test/query-tests/security/CWE-918/mad/Test.java

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,58 @@
1+
import java.net.DatagramSocket;
2+
import java.net.Proxy;
3+
import java.net.Socket;
4+
import java.net.SocketAddress;
15
import java.net.URL;
6+
import java.net.URLClassLoader;
27
import javax.servlet.http.HttpServletRequest;
38
import javafx.scene.web.WebEngine;
49
import org.codehaus.cargo.container.installer.ZipURLInstaller;
510

611
public class Test {
712

8-
public static Object source(HttpServletRequest request) {
13+
private static HttpServletRequest request;
14+
15+
public static Object source() {
916
return request.getParameter(null);
1017
}
1118

19+
public void test(DatagramSocket socket) throws Exception {
20+
// "java.net;DatagramSocket;true;connect;(SocketAddress);;Argument[0];open-url;ai-generated"
21+
socket.connect((SocketAddress) source()); // $ SSRF
22+
}
23+
24+
public void test(URL url) throws Exception {
25+
// "java.net;URL;false;openConnection;(Proxy);:Argument[-1]:open-url;manual"
26+
((URL) source()).openConnection(); // $ SSRF
27+
// "java.net;URL;false;openConnection;(Proxy);:Argument[0]:open-url;ai-generated"
28+
url.openConnection((Proxy) source()); // $ SSRF
29+
// "java.net;URL;false;openStream;;:Argument[-1]:open-url;manual"
30+
((URL) source()).openStream(); // $ SSRF
31+
}
32+
33+
public void test(URLClassLoader cl) throws Exception {
34+
// "java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader);;Argument[1];open-url;manual"
35+
new URLClassLoader("", (URL[]) source(), null); // $ SSRF
36+
// "java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader,URLStreamHandlerFactory);;Argument[1];open-url;manual"
37+
new URLClassLoader("", (URL[]) source(), null, null); // $ SSRF
38+
// "java.net;URLClassLoader;false;URLClassLoader;(URL[]);;Argument[0];open-url;manual"
39+
new URLClassLoader((URL[]) source()); // $ SSRF
40+
// "java.net;URLClassLoader;false;URLClassLoader;(URL[],ClassLoader);;Argument[0];open-url;manual"
41+
new URLClassLoader((URL[]) source(), null); // $ SSRF
42+
// "java.net;URLClassLoader;false;URLClassLoader;(URL[],ClassLoader,URLStreamHandlerFactory);;Argument[0];open-url;manual"
43+
new URLClassLoader((URL[]) source(), null, null); // $ SSRF
44+
// "java.net;URLClassLoader;false;newInstance;;;Argument[0];open-url;manual"
45+
URLClassLoader.newInstance((URL[]) source()); // $ SSRF
46+
}
47+
1248
public void test(WebEngine webEngine) {
1349
// "javafx.scene.web;WebEngine;false;load;(String);;Argument[0];open-url;ai-generated"
14-
webEngine.load((String) source(null)); // $ SSRF
50+
webEngine.load((String) source()); // $ SSRF
1551
}
1652

17-
public void test() {
53+
public void test(ZipURLInstaller zui) {
1854
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[0];open-url:ai-generated"
19-
new ZipURLInstaller((URL) source(null), "", ""); // $ SSRF
55+
new ZipURLInstaller((URL) source(), "", ""); // $ SSRF
2056
}
2157

2258
}

0 commit comments

Comments
 (0)