Skip to content

Commit 7ab193d

Browse files
JLLeitschuhJLLeitschuh
committed
Add System.getProperties().getProperty support
1 parent 31527a6 commit 7ab193d

File tree

10 files changed

+130
-7
lines changed

10 files changed

+130
-7
lines changed

‎java/ql/lib/semmle/code/java/JDK.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
import Member
66
import semmle.code.java.security.ExternalProcess
7+
private import semmle.code.java.dataflow.FlowSteps
78

89
// --- Standard types ---
910
/** The class `java.lang.Object`. */
@@ -249,11 +250,13 @@ class MethodSystemGetenv extends Method {
249250
/**
250251
* Any method named `getProperty` on class `java.lang.System`.
251252
*/
252-
class MethodSystemGetProperty extends Method {
253+
class MethodSystemGetProperty extends ValuePreservingMethod {
253254
MethodSystemGetProperty() {
254255
this.hasName("getProperty") and
255256
this.getDeclaringType() instanceof TypeSystem
256257
}
258+
259+
override predicate returnsValue(int arg) { arg = 1 }
257260
}
258261

259262
/**

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import java
66
import semmle.code.java.dataflow.DataFlow
77
import semmle.code.java.dataflow.TaintTracking
88
import semmle.code.java.dataflow.DefUse
9+
import semmle.code.java.environment.SystemProperty
910
import semmle.code.java.frameworks.Jdbc
1011
import semmle.code.java.frameworks.Networking
1112
import semmle.code.java.frameworks.Properties
@@ -182,6 +183,8 @@ class EnvInput extends LocalUserInput {
182183
// Results from various specific methods.
183184
this.asExpr().(MethodAccess).getMethod() instanceof EnvReadMethod
184185
or
186+
this.asExpr() = getSystemProperty(_)
187+
or
185188
// Access to `System.in`.
186189
exists(Field f | this.asExpr() = f.getAnAccess() | f instanceof SystemIn)
187190
or
@@ -203,6 +206,7 @@ class EnvReadMethod extends Method {
203206
EnvReadMethod() {
204207
this instanceof MethodSystemGetenv or
205208
this instanceof PropertiesGetPropertyMethod or
209+
this instanceof PropertiesGetMethod or
206210
this instanceof MethodSystemGetProperty
207211
}
208212
}

‎java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ private module Frameworks {
1515
private import semmle.code.java.frameworks.android.Intent
1616
private import semmle.code.java.frameworks.android.SQLite
1717
private import semmle.code.java.frameworks.Guice
18+
private import semmle.code.java.frameworks.Properties
1819
private import semmle.code.java.frameworks.Protobuf
1920
private import semmle.code.java.frameworks.guava.Guava
2021
private import semmle.code.java.frameworks.apache.Lang

‎java/ql/lib/semmle/code/java/environment/SystemProperty.qll

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
11
import java
2+
private import semmle.code.java.dataflow.DataFlow
3+
private import semmle.code.java.frameworks.Properties
24
private import semmle.code.java.frameworks.apache.Lang
35

46
/**
57
* Gets an expression that retrieves the value of `propertyName` from `System.getProperty()`.
68
*/
79
Expr getSystemProperty(string propertyName) {
810
result = getSystemPropertyFromSystem(propertyName) or
11+
result = getSystemPropertyFromSystemGetProperties(propertyName) or
912
result = getSystemPropertyFromFile(propertyName) or
1013
result = getSystemPropertyFromApacheSystemUtils(propertyName) or
1114
result = getSystemPropertyFromApacheFileUtils(propertyName) or
@@ -15,15 +18,31 @@ Expr getSystemProperty(string propertyName) {
1518
}
1619

1720
private MethodAccess getSystemPropertyFromSystem(string propertyName) {
18-
result =
19-
any(MethodAccessSystemGetProperty methodAccessSystemGetProperty |
20-
methodAccessSystemGetProperty.hasCompileTimeConstantGetPropertyName(propertyName)
21-
)
21+
result.(MethodAccessSystemGetProperty).hasCompileTimeConstantGetPropertyName(propertyName)
2222
or
2323
exists(Method m | result.getMethod() = m | m.hasName("lineSeparator")) and
2424
propertyName = "line.separator"
2525
}
2626

27+
/**
28+
* A method access that retrieves the value of `propertyName` from the following methods:
29+
* - `System.getProperties().getProperty(...)`
30+
* - `System.getProperties().get(...)`
31+
*/
32+
private MethodAccess getSystemPropertyFromSystemGetProperties(string propertyName) {
33+
exists(Method getMethod |
34+
getMethod instanceof PropertiesGetMethod
35+
or
36+
getMethod instanceof PropertiesGetPropertyMethod and
37+
result.getMethod() = getMethod
38+
) and
39+
result.getArgument(0).(CompileTimeConstantExpr).getStringValue() = propertyName and
40+
DataFlow::localExprFlow(any(MethodAccess m |
41+
m.getMethod().getDeclaringType() instanceof TypeSystem and
42+
m.getMethod().hasName("getProperties")
43+
), result.getQualifier())
44+
}
45+
2746
private FieldAccess getSystemPropertyFromFile(string propertyName) {
2847
result.getField() instanceof FieldFileSeparator and propertyName = "file.separator"
2948
or

‎java/ql/lib/semmle/code/java/frameworks/Properties.qll

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,25 @@
11
/* Definitions related to `java.util.Properties`. */
22
import semmle.code.java.Type
3+
private import semmle.code.java.dataflow.FlowSteps
34

45
library class TypeProperty extends Class {
56
TypeProperty() { hasQualifiedName("java.util", "Properties") }
67
}
78

8-
library class PropertiesGetPropertyMethod extends Method {
9+
library class PropertiesGetPropertyMethod extends ValuePreservingMethod {
910
PropertiesGetPropertyMethod() {
1011
getDeclaringType() instanceof TypeProperty and
1112
hasName("getProperty")
1213
}
14+
15+
override predicate returnsValue(int arg) { arg = 1 }
16+
}
17+
18+
library class PropertiesGetMethod extends Method {
19+
PropertiesGetMethod() {
20+
getDeclaringType() instanceof TypeProperty and
21+
hasName("get")
22+
}
1323
}
1424

1525
library class PropertiesSetPropertyMethod extends Method {

‎java/ql/src/change-notes/2022-02-14-os-guards.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
category: minorAnalysis
33
---
4-
* Add new guards `IsWindowsGuard` and `IsUnixGuard` to detect OS specific guards.
4+
* Add new guards `IsWindowsGuard`, `IsSpecificWindowsVariant`, `IsUnixGuard`, and `IsSpecificUnixVariant` to detect OS specific guards.
5+
* Add new predicate `getSystemProperty` that gets all expressions that retrieve system properties from a variety of sources (eg. alternative JDK API's, Google Guava, Apache Commons, Apache IO, ect..).
56
* Update "Local information disclosure in a temporary directory" (`java/local-temp-file-or-directory-information-disclosure`) to remove false-positives when OS is properly used as logical guard.
7+
* Update "Local information disclosure in a temporary directory" (`java/local-temp-file-or-directory-information-disclosure`) to use `getSystemProperty` to resolve more
68

‎java/ql/test/library-tests/environment/SystemPropertyAccess.java

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
import java.io.File;
2+
import java.util.Properties;
3+
import org.apache.commons.lang3.SystemUtils;
4+
5+
public class SystemPropertyAccess {
6+
private static final Properties SYSTEM_PROPERTIES = System.getProperties();
7+
8+
void test() {
9+
System.getProperty("os.name");
10+
System.getProperty("os.name", "default");
11+
System.getProperties().getProperty("os.name");
12+
System.getProperties().get("java.io.tmpdir");
13+
SYSTEM_PROPERTIES.getProperty("java.home");
14+
SYSTEM_PROPERTIES.get("file.encoding");
15+
System.lineSeparator();
16+
String awtToolkit = SystemUtils.AWT_TOOLKIT;
17+
String fileEncoding = SystemUtils.FILE_ENCODING;
18+
String tmpDir = SystemUtils.JAVA_IO_TMPDIR;
19+
String separator = File.separator;
20+
char separatorChar = File.separatorChar;
21+
String pathSeparator = File.pathSeparator;
22+
char pathSeparatorChar = File.pathSeparatorChar;
23+
}
24+
25+
}

‎java/ql/test/library-tests/environment/SystemPropertyTest.expected

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:93:5:93:50 | AWT_TOOLKIT | awt.toolkit |
2+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:115:5:115:52 | FILE_ENCODING | file.encoding |
3+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:141:5:142:53 | FILE_SEPARATOR | file.separator |
4+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:160:5:160:53 | JAVA_AWT_FONTS | java.awt.fonts |
5+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:178:5:178:59 | JAVA_AWT_GRAPHICSENV | java.awt.graphicsenv |
6+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:199:5:199:56 | JAVA_AWT_HEADLESS | java.awt.headless |
7+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:217:5:217:58 | JAVA_AWT_PRINTERJOB | java.awt.printerjob |
8+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:235:5:235:54 | JAVA_CLASS_PATH | java.class.path |
9+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:253:5:253:57 | JAVA_CLASS_VERSION | java.class.version |
10+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:272:5:272:52 | JAVA_COMPILER | java.compiler |
11+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:308:5:308:52 | JAVA_EXT_DIRS | java.ext.dirs |
12+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:326:5:326:48 | JAVA_HOME | java.home |
13+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:344:5:344:53 | JAVA_IO_TMPDIR | java.io.tmpdir |
14+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:362:5:362:56 | JAVA_LIBRARY_PATH | java.library.path |
15+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:381:5:381:56 | JAVA_RUNTIME_NAME | java.runtime.name |
16+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:400:5:400:59 | JAVA_RUNTIME_VERSION | java.runtime.version |
17+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:418:5:418:62 | JAVA_SPECIFICATION_NAME | java.specification.name |
18+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:436:5:436:64 | JAVA_SPECIFICATION_VENDOR | java.specification.vendor |
19+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:473:5:474:13 | JAVA_UTIL_PREFS_PREFERENCES_FACTORY | java.util.prefs.PreferencesFactory |
20+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:492:5:492:50 | JAVA_VENDOR | java.vendor |
21+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:510:5:510:54 | JAVA_VENDOR_URL | java.vendor.url |
22+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:528:5:528:51 | JAVA_VERSION | java.version |
23+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:547:5:547:51 | JAVA_VM_INFO | java.vm.info |
24+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:565:5:565:51 | JAVA_VM_NAME | java.vm.name |
25+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:583:5:583:65 | JAVA_VM_SPECIFICATION_NAME | java.vm.specification.name |
26+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:601:5:601:67 | JAVA_VM_SPECIFICATION_VENDOR | java.vm.specification.vendor |
27+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:637:5:637:53 | JAVA_VM_VENDOR | java.vm.vendor |
28+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:655:5:655:54 | JAVA_VM_VERSION | java.vm.version |
29+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:674:5:675:53 | LINE_SEPARATOR | line.separator |
30+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:693:5:693:46 | OS_ARCH | os.arch |
31+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:711:5:711:46 | OS_NAME | os.name |
32+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:729:5:729:49 | OS_VERSION | os.version |
33+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:749:5:750:53 | PATH_SEPARATOR | path.separator |
34+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:770:5:770:73 | USER_COUNTRY | user.country |
35+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:788:5:788:47 | USER_DIR | user.dir |
36+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:806:5:806:48 | USER_HOME | user.home |
37+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:825:5:825:52 | USER_LANGUAGE | user.language |
38+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:843:5:843:48 | USER_NAME | user.name |
39+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:861:5:861:52 | USER_TIMEZONE | user.timezone |
40+
| ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:1762:47:1762:63 | JAVA_AWT_HEADLESS | java.awt.headless |
41+
| SystemPropertyAccess.java:9:9:9:37 | getProperty(...) | os.name |
42+
| SystemPropertyAccess.java:10:9:10:48 | getProperty(...) | os.name |
43+
| SystemPropertyAccess.java:11:9:11:53 | getProperty(...) | os.name |
44+
| SystemPropertyAccess.java:12:9:12:52 | get(...) | java.io.tmpdir |
45+
| SystemPropertyAccess.java:15:9:15:30 | lineSeparator(...) | line.separator |
46+
| SystemPropertyAccess.java:16:29:16:51 | SystemUtils.AWT_TOOLKIT | awt.toolkit |
47+
| SystemPropertyAccess.java:17:31:17:55 | SystemUtils.FILE_ENCODING | file.encoding |
48+
| SystemPropertyAccess.java:18:25:18:50 | SystemUtils.JAVA_IO_TMPDIR | java.io.tmpdir |
49+
| SystemPropertyAccess.java:19:28:19:41 | File.separator | file.separator |
50+
| SystemPropertyAccess.java:20:30:20:47 | File.separatorChar | file.separator |
51+
| SystemPropertyAccess.java:21:32:21:49 | File.pathSeparator | path.separator |
52+
| SystemPropertyAccess.java:22:34:22:55 | File.pathSeparatorChar | path.separator |

‎java/ql/test/library-tests/environment/SystemPropertyTest.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import default
2+
import semmle.code.java.environment.SystemProperty
3+
4+
from Expr systemPropertyAccess, string propertyName
5+
where systemPropertyAccess = getSystemProperty(propertyName)
6+
select systemPropertyAccess, propertyName

‎java/ql/test/library-tests/environment/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/apache-commons-lang3-3.7/

0 commit comments

Comments
 (0)